CVE-2021-24247

The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be triggered by any user visiting them, and could allow for privilege escalation. The vendor decided to close the plugin.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

4.68% chance of exploitation in the next 30 days, 91th percentile

Published

2021-05-05

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/e2990a7a-d4f0-424e-b01d-ecf67cf9c9f3

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50703

References

• CVE Record
• NVD entry

Related

• CVE-2021-24246
• CVE-2021-24248
• CVE-2021-24245
• CVE-2021-24249
• CVE-2021-24244
• CVE-2021-24250