CVE-2021-24388

CVE-2021-24388 affects the VikRentCar WordPress plugin prior to 1.1.7. Public sources describe a stored XSS via a non-sanitised/unsafely echoed custom field name and a missing CSRF check on saving settings, enabling a logged-in admin to set arbitrary Custom Fields (including XSS payloads). Exploi...