CVE-2021-24678 CM Tooltip Glossary < 3.9.21 - Contributor+ Stored Cross-Site Scripting

2021-10-0411:20:21

CWE-79

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

24.8%

JSON

The CM Tooltip Glossary WordPress plugin before 3.9.21 does not escape some glossary_tooltip shortcode attributes, which could allow users a role as low as Contributor to perform Stored Cross-Site Scripting attacks

CNA Affected

[
  {
    "product": "CM Tooltip Glossary – Better SEO and UEX for your WP site",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "3.9.21",
        "status": "affected",
        "version": "3.9.21",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/b83880f7-8614-4409-9305-d059b5df15dd

0.001 Low

EPSS

Percentile

24.8%

JSON

Related for CVELIST:CVE-2021-24678