{"cve":"CVE-2021-24431","nvd":{"published":"2021-09-13T18:15:10.937","modified":"2026-06-17T03:40:00.870","status":"Modified","description":"The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This could allow attackers to make a logged in admin change the settings, and set Cross-Site Scripting payload in them, which will be executed in the frontend for all users","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","score":4.3},"cwes":["CWE-79","CWE-352"],"references":["https://wpscan.com/vulnerability/ae50cec9-5f80-4221-b6a8-4593ab66c37b","https://wpscan.com/vulnerability/ae50cec9-5f80-4221-b6a8-4593ab66c37b"],"products":["language_bar_flags_project:language_bar_flags"],"source":"nvd","synced_at":"2026-10-19T21:23:41.316049955+00:00"},"epss":{"cve":"CVE-2021-24431","score":0.00483,"percentile":0.41645,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}