Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2021-24901
HistoryFeb 28, 2022 - 9:15 a.m.

CVE-2021-24901

2022-02-2809:15:08
CWE-79
[email protected]
web.nvd.nist.gov
4
cve-2021-24901
security audit
wordpress plugin
cross-site scripting
data id setting
high privilege users
unfiltered_html capability

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

38.3%

JSON

The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Affected configurations

Nvd
Node
securemozsecurity_auditRange≤1.0.0wordpress
VendorProductVersionCPE
securemozsecurity_audit*cpe:2.3:a:securemoz:security_audit:*:*:*:*:*:wordpress:*:*

Related

cvelist 1
wpexploit 1
patchstack 1
packetstorm 1
exploitdb 1
wpvulndb 1
zdt 1
cve 1
prion 1
cvelist
cvelist
CVE-2021-24901 Security Audit <= 1.0.0 - Admin+ Stored Cross Site Scripting
2022-02-28 09:06:17
wpexploit
wpexploit
Security Audit <= 1.0.0 - Admin+ Stored Cross Site Scripting
2021-11-15 00:00:00
patchstack
patchstack
WordPress Security Audit plugin <= 1.0.0 - Stored Cross-Site Scripting (XSS) vulnerability
2022-01-26 00:00:00
packetstorm
packetstorm
WordPress Security Audit 1.0.0 Cross Site Scripting
2022-02-08 00:00:00
exploitdb
exploitdb
WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS)
2022-02-08 00:00:00
wpvulndb
wpvulndb
Security Audit <= 1.0.0 - Admin+ Stored Cross Site Scripting
2021-11-15 00:00:00
zdt
zdt
WordPress Security Audit 1.0.0 Plugin - Stored Cross Site Scripting Vulnerability
2022-02-08 00:00:00
cve
cve
CVE-2021-24901
2022-02-28 09:15:08
prion
prion
Cross site scripting
2022-02-28 09:15:00

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

38.3%

JSON
Related for NVD:CVE-2021-24901
cvelist1wpexploit1patchstack1packetstorm1exploitdb1wpvulndb1zdt1cve1prion1