CVE-2021-24720

🗓️ 11 Oct 2021 10:45:50Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 49 Views🌐 WEB

The GeoDirectory WordPress plugin before 2.1.1.3 is prone to Authenticated Stored XSS

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2021-24720	11 Oct 202114:24	–	circl
CNNVD	WordPress 插件跨站脚本漏洞	11 Oct 202100:00	–	cnnvd
CNVD	WordPress GeoDirectory Business Director plugin cross-site scripting vulnerability	13 Oct 202100:00	–	cnvd
Cvelist	CVE-2021-24720 GeoDirectory < 2.1.1.3 - Authenticated Stored Cross-Site Scripting (XSS)	11 Oct 202110:45	–	cvelist
EUVD	EUVD-2021-11632	7 Oct 202500:30	–	euvd
NVD	CVE-2021-24720	11 Oct 202111:15	–	nvd
OSV	CVE-2021-24720	11 Oct 202111:15	–	osv
Patchstack	WordPress GeoDirectory plugin <= 2.1.1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	2 Sep 202100:00	–	patchstack
Prion	Cross site scripting	11 Oct 202111:15	–	prion
RedhatCVE	CVE-2021-24720	22 May 202520:31	–	redhatcve

NVD

Vulners

Node

ayecode geodirectoryRange<2.1.1.3wordpress

[
  {
    "product": "Business Directory Plugin | GeoDirectory",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.1.1.3",
        "status": "affected",
        "version": "2.1.1.3",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/2596452/geodirectory
wpscan	www.wpscan.com/vulnerability/9de5cc51-f64c-4475-a0f4-d932dc4364a6
github	www.github.com/BigTiger2020/word-press/blob/main/WrodPress%20Plugin%20GeoDirectory%E2%80%94%E2%80%94Stored%20Cross-Site%20Scripting%20.md

Parameter	Position	Path	Description	CWE
default_location_latitude	request body	/wp-admin/admin.php?page=gd-settings&tab=general&section=location	Authenticated Stored Cross-Site Scripting (XSS) in GeoDirectory plugin before 2.1.1.3 via POST parameter default_location_latitude	CWE-79

21 Nov 2024 05:53Current

5.2Medium risk

Vulners AI Score5.2

CVSS 23.5

CVSS 3.15.4

EPSS0.00514

CWE-79