Remove Footer Credit < 1.0.6 - CSRF to Stored Cross-Site Scripting
Priority LOW 24CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation
Why it matters now
EPSS 0.00329 26th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Remove Footer Credit (Unknown): 1.0.6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Remove Footer Credit | 1.0.6 to before 1.0.6 | 1.0.6 | Patch available | CNA |
- Remove Footer Credit VendorUnknown Affected 1.0.6 to before 1.0.6 Fixed in 1.0.6 Patch available CNA
Remediation
- Fix · CNA Remove Footer Credit (Unknown) Fixed in 1.0.6
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24446
- 2026-10-03 Alias added: GHSA-h45f-f9w2-prgp
References
More wpchill Remove Footer Credit vulnerabilities
- TI-2024-21324 WordPress Remove Footer Credit plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 5.9
- TI-2021-07328 Remove Footer Credit < 1.0.11 - Admin+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.8
Sources
- CVE-2021-24446 · CVE Program
- CVE-2021-24446 · NVD
- FIRST EPSS
- GHSA-h45f-f9w2-prgp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences