CVE-2021-24272: Fitness Calculators < 1.9.6 - Cross-Site Request Forgery to Cross-Site Scripting (XSS)

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-05-05 · updated 2026-06-17
Weakness: CWE-352

Description

The fitness calculators WordPress plugin before 1.9.6 add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers. Due to the lack of sanitisation, this could also lead to a Stored Cross-Site Scripting issue

Affected products

fitness calculators: before 1.9.6 — fixed in 1.9.6

How to fix

Upgrade to a fixed version: fitness calculators 1.9.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-24272 or the next vulnerability affects your stack