CVE-2021-24789

The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2021-24789 Flat Preloader < 1.5.5 - Admin+ Stored Cross-Site Scripting

The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2021-24789

The CVE refers to WordPress Flat Preloader plugin pre-1.5.5. Connected sources confirm a cross-site scripting (XSS) vulnerability where certain settings are not escaped when output in HTML attributes, enabling an attacker with admin-level access to trigger client-side JS even when unfiltered_html...