CVE-2021-24290

· MEDIUMModified

← All CVEs

CVSS v3.1

6.1

EPSS

0.83%

Published

May 17, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

Affected Products (1)

de-baat · store_locator_plusvulnerable

References (4)

https://wpscan.com/vulnerability/dc368484-f2fe-4c76-ba3d-e00e7f633719

Third Party Advisory

https://www.wordfence.com/blog/2021/04/severe-unpatched-vulnerabilities-leads-to-closure-of-store-locator-plus-plugin

Third Party Advisory

https://wpscan.com/vulnerability/dc368484-f2fe-4c76-ba3d-e00e7f633719

Third Party Advisory

https://www.wordfence.com/blog/2021/04/severe-unpatched-vulnerabilities-leads-to-closure-of-store-locator-plus-plugin

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs