CVE-2021-24332

Autoptimize < 2.8.4 - Authenticated Stored Cross-Site Scripting (XSS)

EPSS 0.6%CWE-79

Vexday Risk Score

3Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS —EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

24 may 2021Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues

Productos afectados

Unknown · Autoptimize

Referencias

https://m0ze.ru/vulnerability/%5B2021-04-01%5D-%5BWordPress%5D-%5BCWE-79%5D-Autoptimize-WordPress-Plugin-v2.8.3.txt https://wpscan.com/vulnerability/6678e064-ce21-4bb2-8c50-061073fb22fb