CVE-2021-24409

The CVE-2021-24409 entry concerns the Prismatic WordPress plugin (prior to v2.8). The vulnerability is a reflected Cross-Site Scripting (XSS) flaw caused by the plugin not escaping the 'tab' GET parameter before echoing it into an HTML attribute, leading to execution in the context of a logged-in...

CVE-2021-24408

CVE-2021-24408 involves the Prismatic WordPress plugin, vulnerable in versions before 2.8. It does not sanitize/validate certain shortcode parameters, enabling stored XSS from users with roles as low as Contributor. A contributor-created post requires admin approval for the XSS to trigger in the ...