CVE-2021-24605

The create_post_page AJAX action of the Custom Post View Generator WordPress plugin through 0.4.6 (available to authenticated user) does not sanitise or escape user input before outputting it back in the response, leading to a Reflected Cross-Site issue

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.62% chance of exploitation in the next 30 days, 47th percentile

Published

2021-09-13

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/e0be384c-3e63-49f6-b2ab-3024dcd88686

References

• CVE Record
• NVD entry

Related

• CVE-2021-24604
• CVE-2021-24606
• CVE-2021-24603
• CVE-2021-24607
• CVE-2021-24601
• CVE-2021-24608