CVE-2021-24888 ImageBoss < 3.0.6 - Admin+ Stored Cross-Site Scripting

The ImageBoss WordPress plugin before 3.0.6 does not sanitise and escape its Source Name setting, which could allow high privilege users to perform Cross-Site Scripting attacks...

CVE-2021-24888

CVE-2021-24888 affects the WordPress ImageBoss plugin prior to version 3.0.6. The root cause is failure to sanitize/escape the Source Name setting, enabling stored XSS that could be exploited by high-privilege users. The vulnerability is described as an Admin+ stored cross-site scripting issue, i...