CVE-2021-25029
Cluevo < 1.8.1 - Admin+ Stored Cross Site Scripting
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
07 Feb 2022Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The CLUEVO LMS, E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Affected products
Unknown · CLUEVO LMS, E-Learning Platform