What’s Vulnerable › Vulnerabilities

CVE-2021-24818: WP Limits <= 1.0 - Plugin's Settings Update via CSRF

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-12-13 · updated 2026-06-17
• Weakness: CWE-352

Description

The WP Limits WordPress plugin through 1.0 does not have CSRF check when saving its settings, allowing attacker to make a logged in admin change them, which could make the blog unstable by setting low values

Affected products

• Wp Limits: through 1.0

References

• https://wpscan.com/vulnerability/7cd524ed-5eb9-4d6b-b4d2-3d4be6b57879
• https://wpscan.com/vulnerability/7cd524ed-5eb9-4d6b-b4d2-3d4be6b57879

Get alerted when CVE-2021-24818 or the next vulnerability affects your stack