CVE-2021-24732

The CVE concerns the DearFlip (Dflip Lite) WordPress plugin, prior to version 1.7.10. The vulnerability arises from not escaping the class attribute of the plugin’s shortcode before outputting it in an attribute, enabling Stored Cross-Site Scripting by users with as low as Contributor privileges....