CVE-2021-24564

The WPFront Scroll Top WordPress plugin before 2.0.6.07225 does not sanitise or escape its Image ALT setting before outputting it attributes, leading to an Authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.

Affected products

Wpfront Scroll Top

Wpfront Scroll Top

< 2.0.6.07225

Fix

Available

CVSS 3.1

5.4 MEDIUM

EPSS

0.6% (48th percentile)

Weakness

CWE-79

NVD status

Modified

Published

2021-08-23