CVE-2021-24218

Name of the Vulnerable Software and Affected Versions: Facebook for WordPress plugin versions prior to 3.0.4

Description: The issue concerns the wp ajax save fbe settings and wp ajax delete fbe settings AJAX actions, which were vulnerable to CSRF due to a lack of nonce protection. Additionally, the settings in the saveFbeSettings function had no sanitization, allowing for script tags to be saved.

Recommendations: For versions prior to 3.0.4, update to version 3.0.4 or later to resolve the issue. As a temporary workaround, consider disabling the wp ajax save fbe settings and wp ajax delete fbe settings AJAX actions until a patch is available. Restrict access to the saveFbeSettings function to minimize the risk of exploitation. Avoid using the settings in the saveFbeSettings function that allow for script tags to be saved until the issue is resolved.