CVE-2021-24988
The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks, allowing any authenticated users, such as subscriber to call it and set a malicious payload in the addon parameter.
- Affected products
- Wp Rss Aggregator
- Wprssaggregator Wp Rss Aggregator
- < 4.19.3
- Fix
- Available
- CVSS 3.1
- 5.4 MEDIUM
- EPSS
- 0.3% (22th percentile)
- Weakness
- CWE-352, CWE-862, CWE-79
- NVD status
- Modified
- Published
- 2021-12-27
CVE-2021-24988 at NVD
1 known exploit for CVE-2021-24988
Proof-of-concept code and exploit modules indexed by Sploitus