CVE-2021-24128 Team Members < 5.0.4 - Authenticated Stored Cross-Site Scripting (XSS)

2021-03-1814:57:48

CWE-79

WPScan

www.cve.org

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.8%

JSON

Unvalidated input and lack of output encoding in the Team Members WordPress plugin, versions before 5.0.4, lead to Cross-site scripting vulnerabilities allowing medium-privileged authenticated attacker (contributor+) to inject arbitrary web script or HTML via the ‘Description/biography’ of a member.

CNA Affected

[
  {
    "product": "Team Members",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "5.0.4",
        "status": "affected",
        "version": "5.0.4",
        "versionType": "custom"
      }
    ]
  }
]