Read the docs
TI-2021-04008 Aliases CVE-2021-20782GHSA-5xvg-cwvf-6x65

Cross-site request forgery in Tips and Tricks HQ Software License Manager

Priority MEDIUM 40CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

Cross-site request forgery (CSRF) vulnerability in Software License Manager versions prior to 4.4.6 allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Why it matters now

EPSS 0.00871 59th percentileScored 2026-11-07
Fix Fixed Software License Manager (Tips and Tricks HQ): 4.4.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Tips and Tricks HQSoftware License Managerbefore 4.4.64.4.6Patch availableCNA
  • Software License Manager VendorTips and Tricks HQ Affected before 4.4.6 Fixed in 4.4.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tipsandtricks-hq:software_license_manager:*:*:*:*:*:wordpress:*:*before 4.4.6Vulnerablemra13
  • cpe:2.3:a:tipsandtricks-hq:software_license_manager:*:*:*:*:*:wordpress:*:* Versions before 4.4.6 Vulnerable ·mra13

Remediation

  • Fix · CNA Software License Manager (Tips and Tricks HQ) Fixed in 4.4.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-20782
  2. 2026-10-03 Alias added: GHSA-5xvg-cwvf-6x65

References

Advisory 3

  • TI-2026-39614 WordPress WP eMember plugin < v10.9.4 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
  • TI-2020-04618 SQL injection in Tips and Tricks HQ Simple Download Monitor CVSS 3.1HIGH 8.8
  • TI-2014-05140 Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin… CVSS 2.0MEDIUM 6.5
  • TI-2024-22178 WordPress Easy Accept Payments for PayPal plugin <= 4.9.10 - Broken Access Control vulnerability CVSS 3.1HIGH 7.5
  • TI-2024-20251 WordPress WP Express Checkout plugin <= 2.3.7 - Price Manipulation vulnerability CVSS 3.1HIGH 7.5
  • TI-2015-00834 Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall… CVSS 2.0MEDIUM 6.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences