CVE-2021-24218

HIGH 8.8CVE-2021-24218 · Published 12/04/2021 · updated 17/06/2026

In short

CVE-2021-24218 is a HIGH (CVSS 8.8) vulnerability affecting facebook (facebook).
Chance of exploitation in the next 30 days (EPSS): 0.70%, higher than 53.1% of all vulnerabilities.
Fix: update to 3.0.4 or later.

Package	Affected versions	Patched versions
facebook facebook	`≥ 3.0.0, < 3.0.4`	`3.0.4`

Description

The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved.

References

wpscan.com/vulnerability/169d21fc-d191-46ff-82e8-9ac887aed8a4 · Exploit
wordfence.com/blog/2021/03/two-vulnerabilities-patched-in-facebook-for-wordpress-plugin · Exploit

More vulnerabilities in facebook

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free