CVE-2021-24792
Shiny Buttons <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
13 Dec 2021Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template (wpbtn_save_template function hooked to the init action), nor sanitise and escape them before outputting them in the admin dashboard, which allow unauthenticated users to add a malicious template and lead to Stored Cross-Site Scripting issues.
Affected products
Unknown · Shiny Buttons – CSS3 Button Generator for WordPressWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →