CVE-2021-24587 Splash Header < 1.20.8 - Authenticated Stored Cross-Site Scripting (XSS)

2021-09-2010:06:24

CWE-79

WPScan

www.cve.org

cve-2021-24587

wordpress

authenticated stored cross-site scripting

EPSS

0.001

Percentile

24.8%

JSON

The Splash Header WordPress plugin before 1.20.8 doesn’t sanitise and escape some of its settings while outputting them in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue.

CNA Affected

[
  {
    "product": "Splash Header",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.20.8",
        "status": "affected",
        "version": "1.20.8",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/bb5d94ad-e1ce-44e2-8403-d73fe75a146a

EPSS

0.001

Percentile

24.8%

JSON

Related for CVELIST:CVE-2021-24587