Vulnerability Description
The Related Posts for WordPress plugin through 2.0.4 does not sanitise its heading_text and CSS settings, allowing high privilege users (admin) to set XSS payloads in them, leading to Stored Cross-Site Scripting issues.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Never5 | Related Posts | <= 2.0.4 |
Related Weaknesses (CWE)
References
- https://m0ze.ru/vulnerability/%5B2021-04-18%5D-%5BWordPress%5D-%5BCWE-79%5D-Rela
- https://wpscan.com/vulnerability/2f86e418-22fd-4cb8-8de1-062b17cf20a7ExploitThird Party Advisory
- https://m0ze.ru/vulnerability/%5B2021-04-18%5D-%5BWordPress%5D-%5BCWE-79%5D-Rela
- https://wpscan.com/vulnerability/2f86e418-22fd-4cb8-8de1-062b17cf20a7ExploitThird Party Advisory
FAQ
What is CVE-2021-24482?
CVE-2021-24482 is a vulnerability with a CVSS score of 4.8 (MEDIUM). The Related Posts for WordPress plugin through 2.0.4 does not sanitise its heading_text and CSS settings, allowing high privilege users (admin) to set XSS payloads in them, leading to Stored Cross-Sit...
How severe is CVE-2021-24482?
CVE-2021-24482 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-24482?
Check the references section above for vendor advisories and patch information. Affected products include: Never5 Related Posts.