CVE-2021-24290 Store Locator Plus <= 5.5.15 - Unauthenticated Stored Cross-Site Scripting (XSS)

2021-05-1716:48:53

CWE-79

WPScan

www.cve.org

cve-2021-24290

store locator plus

unauthenticated stored xss

EPSS

0.001

Percentile

30.8%

JSON

There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages.

CNA Affected

[
  {
    "product": "Store Locator Plus for WordPress",
    "vendor": "Store Locator Plus®",
    "versions": [
      {
        "lessThanOrEqual": "5.5.15",
        "status": "affected",
        "version": "5.5.15",
        "versionType": "custom"
      }
    ]
  }
]