{"id":"CVE-2021-24805","aliases":["EUVD-2021-11717","GHSA-5j45-463h-x7wv"],"status":"published","title":"DW Question \u0026 Answer Pro \u003c= 1.3.4 - Multiple CSRF","description":"The DW Question \u0026 Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in some of its functions, allowing attackers to make logged in users perform unwanted actions, such as update a comment or a question status.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00435,"percentile":0.3831,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2022-04-25T15:50:43Z","modified":"2026-06-17T03:40:56Z","products":[{"vendor":"designwall","product":"dw_question_\\\u0026_answer"},{"vendor":"unknown","product":"dw question answer pro"}],"references":[{"url":"https://wpscan.com/vulnerability/a6be3fcf-60f7-4f13-b773-871a7296113c","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-24805"},{"url":"https://github.com/advisories/GHSA-5j45-463h-x7wv"}],"sources":{"cve":[{"id":"CVE-2021-24805","title":"DW Question \u0026 Answer Pro \u003c= 1.3.4 - Multiple CSRF","description":"The DW Question \u0026 Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in some of its functions, allowing attackers to make logged in users perform unwanted actions, such as update a comment or a question status.","status":"published","published":"2022-04-25T15:50:43Z","modified":"2024-08-03T19:42:17.212Z","cwes":["CWE-352"],"updated_at":"2026-11-02T14:33:05.000797Z"}],"euvd":[{"id":"EUVD-2021-11717","description":"The DW Question \u0026 Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in some of its functions, allowing attackers to make logged in users perform unwanted actions, such as update a comment or a question status.","status":"published","published":"2022-04-25T15:50:43Z","modified":"2024-08-03T19:42:17Z","updated_at":"2026-11-03T03:24:55.867627Z"}],"ghsa":[{"id":"GHSA-5j45-463h-x7wv","title":"The DW Question \u0026 Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in...","description":"The DW Question \u0026 Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in some of its functions, allowing attackers to make logged in users perform unwanted actions, such as update a comment or a question status.","status":"published","published":"2022-04-26T00:00:41Z","modified":"2023-01-27T05:02:02Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:42:00.381555Z"}],"nvd":[{"id":"CVE-2021-24805","description":"The DW Question \u0026 Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in some of its functions, allowing attackers to make logged in users perform unwanted actions, such as update a comment or a question status.","status":"published","published":"2022-04-25T16:16:06.997Z","modified":"2026-06-17T03:40:56.33Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:07:06.029737Z"}]}}