CVE-2021-24938

🗓️ 06 Dec 2021 15:55:37Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 52 Views🌐 WEB

The WOOCS WordPress plugin before 1.3.7.1 is prone to Reflected Cross-Site Scripting (XSS) via the key parameter of the woocs_update_profiles_data AJAX action

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2021-24938	6 Dec 202118:20	–	circl
CNNVD	WordPress 插件跨站脚本漏洞	6 Dec 202100:00	–	cnnvd
CNVD	WordPress WOOCS plugin cross-site scripting vulnerability	9 Dec 202100:00	–	cnvd
Cvelist	CVE-2021-24938 WooCommerce Currency Switcher < 1.3.7.1 - Reflected Cross-Site Scripting	6 Dec 202115:55	–	cvelist
EUVD	EUVD-2021-11850	7 Oct 202500:30	–	euvd
NVD	CVE-2021-24938	6 Dec 202116:15	–	nvd
OSV	CVE-2021-24938	6 Dec 202116:15	–	osv
Patchstack	WordPress WOOCS – Currency Switcher for WooCommerce plugin <= 1.3.7 - Reflected Cross-Site Scripting (XSS) vulnerability	8 Nov 202100:00	–	patchstack
Prion	Cross site scripting	6 Dec 202116:15	–	prion
RedhatCVE	CVE-2021-24938	22 May 202518:25	–	redhatcve

NVD

Vulners

Node

woocommerce woocommerce_currency_switcherRange<1.3.7.1wordpress

[
  {
    "product": "WOOCS – Currency Switcher for WooCommerce. Professional and Free multi currency plugin – Pay in selected currency",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.3.7.1",
        "status": "affected",
        "version": "1.3.7.1",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/df8a6f2c-e075-45d5-9262-b4eb63c9351e

Parameter	Position	Path	Description	CWE
key	request body	/wp-admin/admin-ajax.php	Reflected XSS in WOOCS plugin: key parameter echoed in response without sanitisation/escaping (CVE-2021-24938).	CWE-79

17 Jun 2026 03:41Current

6Medium risk

Vulners AI Score6

CVSS 24.3

CVSS 3.16.1

EPSS0.00795

CWE-79