CVE-2021-24277 RSS for Yandex Turbo < 1.30 - Authenticated Stored Cross-Site Scripting (XSS)

2021-05-1411:38:16

CWE-79

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

24.8%

JSON

The RSS for Yandex Turbo WordPress plugin before 1.30 did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in the page, leading to authenticated stored Cross-Site Scripting issues

CNA Affected

[
  {
    "product": "RSS for Yandex Turbo",
    "vendor": "Flector",
    "versions": [
      {
        "lessThan": "1.30",
        "status": "affected",
        "version": "1.30",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/8ebf56be-46c0-4435-819f-dc30370eafa4

0.001 Low

EPSS

Percentile

24.8%

JSON

Related for CVELIST:CVE-2021-24277