CVE-2021-24567

2024-01-1616:15:09

CWE-79

WPScan

web.nvd.nist.gov

simple post

wordpress

plugin

cve-2021-24567

authenticated stored xss

nvd

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

Percentile

14.0%

JSON

The Simple Post WordPress plugin through 1.1 does not sanitize user input when an authenticated user Text value, then it does not escape these values when outputting to the browser leading to an Authenticated Stored XSS Cross-Site Scripting issue.

Affected configurations

Nvd

Vulners

Node

nickmomriksimple_postRange≤1.1wordpress

VendorProductVersionCPE
nickmomriksimple_post*cpe:2.3:a:nickmomrik:simple_post:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
nickmomrik	simple_post	*	cpe:2.3:a:nickmomrik:simple_post::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Simple Post",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "1.1"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]