CVE-2021-24878

🗓️ 07 Feb 2022 15:47:10Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 54 Views🌐 WEB

The SupportCandy WordPress plugin before 2.2.7 is prone to a Reflected Cross-Site Scripting issue

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2021-24878	7 Feb 202218:35	–	circl
CNNVD	Wordpress Plugin SupportCandy 跨站脚本漏洞	7 Feb 202200:00	–	cnnvd
Cvelist	CVE-2021-24878 SupportCandy < 2.2.7 - Reflected Cross-Site Scripting	7 Feb 202215:47	–	cvelist
EUVD	EUVD-2021-11790	7 Oct 202500:30	–	euvd
Nuclei	SupportCandy < 2.2.7 - Reflected Cross-Site Scripting	7 Jun 202603:02	–	nuclei
NVD	CVE-2021-24878	7 Feb 202216:15	–	nvd
Patchstack	WordPress SupportCandy plugin <= 2.2.6 - Reflected Cross-Site Scripting (XSS) vulnerability	5 Jan 202200:00	–	patchstack
Prion	Cross site scripting	7 Feb 202216:15	–	prion
Positive Technologies	PT-2022-9489	7 Feb 202200:00	–	ptsecurity
RedhatCVE	CVE-2021-24878	22 May 202519:24	–	redhatcve

NVD

Vulners

Node

supportcandy supportcandyRange<2.2.7wordpress

[
  {
    "product": "SupportCandy – Helpdesk & Support Ticket System",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.2.7",
        "status": "affected",
        "version": "2.2.7",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/d2f1fd60-5e5e-4e38-9559-ba2d14ae37bf

Parameter	Position	Path	Description	CWE
	query param	/ticket-creation/?};alert(/XSS/)//=1	Reflected XSS due to unsanitized query string echoed on the ticket creation page with the [wpsc_create_ticket] shortcode embed	CWE-79

21 Nov 2024 05:53Current

6Medium risk

Vulners AI Score6

CVSS 24.3

CVSS 3.16.1

EPSS0.00368

CWE-79