CVE-2021-24581

The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack.

The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack.

El plugin Blue Admin de WordPress versiones hasta 21.06.01, no sanea ni escapa de su configuración "Logo Title" antes de mostrarla en una página, conllevando a un problema de tipo Cross-Site Scripting Almacenado. Además, el plugin no presenta una comprobación de tipo CSRF cuando guarda su configuración, permitiendo que el problema sea explotado por medio de un ataque CSRF.