CVE-2021-24615

5.4 mediumEPSS 0.4%

Medium (5.4) in wechat reward project wechat reward. EPSS 0.4% chance of exploitation in the next 30 days.

The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-352
Published: 2021-10-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

wechat_reward_project:wechat_reward

References

https://wpscan.com/vulnerability/9d48313b-76d7-4252-9b81-2fdd0373561b
https://wpscan.com/vulnerability/9d48313b-76d7-4252-9b81-2fdd0373561b

Check your stack JSON