CVE-2021-24287

· MEDIUMModified

← All CVEs

CVSS v3.1

6.1

EPSS

10.36%

Published

May 14, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (3)

All weaponized →

Exploit-DBWordPress Plugin Select All Categories and Taxonomies 1.3.1 - Reflected Cross-Site Scripting (XSS)NucleiNuclei detection template TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

Affected Products (1)

mooveagency · select_all_categories_and_taxonomies\,_change_checkbox_to_radio_buttons (up to 1.3.2)vulnerable

References (4)

http://packetstormsecurity.com/files/164327/WordPress-Select-All-Categories-And-Taxonomies-1.3.1-Cross-Site-Scripting.html

ExploitThird Party AdvisoryVDB Entry

https://wpscan.com/vulnerability/56e1bb56-bfc5-40dd-b2d0-edef43d89bdf

ExploitThird Party Advisory

http://packetstormsecurity.com/files/164327/WordPress-Select-All-Categories-And-Taxonomies-1.3.1-Cross-Site-Scripting.html

ExploitThird Party AdvisoryVDB Entry

https://wpscan.com/vulnerability/56e1bb56-bfc5-40dd-b2d0-edef43d89bdf

ExploitThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs