CVE-2021-24616

AddToAny Share Buttons < 1.7.48 - Admin+ Stored Cross-Site Scripting

EPSS 0.7%CWE-79

Vexday Risk Score

3Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS —EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

08 nov 2021Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The AddToAny Share Buttons WordPress plugin before 1.7.48 does not escape its Image URL button setting, which could lead allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Produtos afetados

Unknown · AddToAny Share Buttons

Referências

https://plugins.trac.wordpress.org/changeset/2609928/https://wpscan.com/vulnerability/04eaf380-c345-425f-8800-142e3f4745a9