3 matches found
CVE-2021-24933
The Dynamic Widgets WordPress plugin through 1.5.16 does not escape the prefix parameter before outputting it back in an attribute when using the termtree AJAX action available to any authenticated users, leading to a Reflected Cross-Site Scripting issue...
5.4CVSS6.1AI score0.006EPSS
SaveExploits2References1
CVE-2021-24933
The CVE-2021-24933 entry concerns WordPress Dynamic Widgets plugin
5.4CVSS5.3AI score0.006EPSS
SaveExploits2References1Affected Software1
CVE-2021-24933 Dynamic Widgets <= 1.5.16 - Reflected Cross-Site Scripting
The Dynamic Widgets WordPress plugin through 1.5.16 does not escape the prefix parameter before outputting it back in an attribute when using the termtree AJAX action available to any authenticated users, leading to a Reflected Cross-Site Scripting issue...
5.6AI score0.006EPSS
SaveExploits2References1
20