Lucene search
WPScanCVELIST:CVE-2021-24408HistoryJul 12, 2021 - 7:20 p.m.
CVE-2021-24408 Prismatic < 2.8 - Contributor+ Stored XSS
2021-07-1219:20:51
CWE-79
WPScan
www.cve.org
2
prismatic
wordpress plugin
cve-2021-24408
contributor
stored xss
cross-site payload
admin approval
EPSS
0.001
Percentile
24.8%
The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters, allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS trigger able in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.
CNA Affected
[
{
"product": "Prismatic",
"vendor": "Jeff Starr",
"versions": [
{
"lessThan": "2.8",
"status": "affected",
"version": "2.8",
"versionType": "custom"
}
]
}
]Related
cve
cve
CVE-2021-24408
2021-07-12 20:15:08
prion
prion
Cross site scripting
2021-07-12 20:15:00
wpvulndb
wpvulndb
Prismatic < 2.8 - Contributor+ Stored XSS
2021-06-21 00:00:00
patchstack
patchstack
cnvd
cnvd
WordPress Plugin Cross-Site Scripting Vulnerability (CNVD-2021-59592)
2021-07-14 00:00:00
nvd
nvd
CVE-2021-24408
2021-07-12 20:15:08
wpexploit
wpexploit
Prismatic < 2.8 - Contributor+ Stored XSS
2021-06-21 00:00:00