The "Schedule Name" input in the Weekly Schedule WordPress plugin before 3.4.3 general options did not properly sanitize input, allowing a user to inject javascript code using the <script> HTML tags and cause a stored XSS issue
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/ba1d01dc-16e4-464f-94be-ed311ff6ccf9 | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: WPScan
Published: 2021-06-01T11:33:29
Updated: 2021-06-01T11:33:29
Reserved: 2021-01-14T00:00:00
Link: CVE-2021-24309
JSON object: View
NVD Information
Status : Analyzed
Published: 2021-06-01T14:15:08.787
Modified: 2021-06-09T00:45:34.847
Link: CVE-2021-24309
JSON object: View
Redhat Information
No data.
CWE