CVE-2021-24409

The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator...

CVE-2021-24409

The CVE-2021-24409 entry concerns the Prismatic WordPress plugin (prior to v2.8). The vulnerability is a reflected Cross-Site Scripting (XSS) flaw caused by the plugin not escaping the 'tab' GET parameter before echoing it into an HTML attribute, leading to execution in the context of a logged-in...