CVE-2021-24479 DrawBlog <= 0.90 - Authenticated Stored Cross-Site Scripting (XSS)

2021-08-0210:32:19

CWE-79

WPScan

raw.githubusercontent.com

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.1%

JSON

The DrawBlog WordPress plugin through 0.90 does not sanitise or validate some of its settings before outputting them back in the page, leading to an authenticated stored Cross-Site Scripting issue