CVE-2021-24277

The CVE-2021-24277 entry concerns the WordPress plugin RSS for Yandex Turbo prior to v1.30. The vulnerability is an authenticated stored cross-site scripting (XSS) flaw caused by improper sanitization of user inputs in the Счетчики settings tab. This allows stored JavaScript payloads to execute w...

CVE-2021-24277 RSS for Yandex Turbo < 1.30 - Authenticated Stored Cross-Site Scripting (XSS)

The RSS for Yandex Turbo WordPress plugin before 1.30 did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in the page, leading to authenticated stored Cross-Site Scripting issues...