CVE-2021-4378: WP Quick FrontEnd Editor <= 5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with minimal permissions like subscribers, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-4378?
CVE-2021-4378 is a vulnerability in the WP Quick FrontEnd Editor plugin for WordPress that allows authenticated attackers, with minimal permissions, to inject arbitrary scripts.
How does CVE-2021-4378 affect the WP Quick FrontEnd Editor plugin?
CVE-2021-4378 affects the WP Quick FrontEnd Editor plugin for WordPress versions up to and including 5.5 due to insufficient input sanitization and output escaping, which allows for stored cross-site scripting.
What is the severity of CVE-2021-4378?
CVE-2021-4378 has a severity rating of medium with a severity value of 5.4.
How can authenticated attackers exploit CVE-2021-4378?
Authenticated attackers with minimal permissions, like subscribers, can exploit CVE-2021-4378 by injecting arbitrary scripts into the WP Quick FrontEnd Editor.
Is there a fix available for CVE-2021-4378?
Yes, it is recommended to update to a patched version of the WP Quick FrontEnd Editor plugin to fix CVE-2021-4378.