CVE-2021-24277

The RSS for Yandex Turbo WordPress plugin before 1.30 did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in the page, leading to authenticated stored Cross-Site Scripting issues

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.62% chance of exploitation in the next 30 days, 47th percentile

Published

2021-05-14

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/8ebf56be-46c0-4435-819f-dc30370eafa4

References

• CVE Record
• NVD entry

Related

• CVE-2021-24276
• CVE-2021-24278
• CVE-2021-24275
• CVE-2021-24279
• CVE-2021-24274
• CVE-2021-24280