CVE-2021-24830

Advanced Access Manager < 6.8.0 - Admin+ Stored Cross-Site Scripting

EPSS 0.7%CWE-79

Vexday Risk Score

3Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS —EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

23 nov 2021Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Productos afectados

Unknown · Advanced Access Manager

Referencias

https://plugins.trac.wordpress.org/changeset/2616161/https://wpscan.com/vulnerability/1c46373b-d43d-4d18-b0ae-3711fb0be0f9