CVE-2021-24516
PlanSo Forms <= 2.6.3 - Authenticated Stored Cross-Site Scripting
Vexday Risk Score
3Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS —EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
18 out 2021Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high privilege users such as admin to set XSS payload in it, even when the unfiltered_html is disallowed, leading to an Authenticated Stored Cross-Site Scripting issue.
Produtos afetados
Unknown · PlanSo Forms