CVE-2021-24380: Shantz WordPress Qotd Project Shantz WordPress Qotd

Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days.

The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values.

Affected products

• Shantz WordPress Qotd Project Shantz WordPress Qotd: up to and including 1.2.2

Published 2021-08-16. Last modified 2026-06-17.