CVE-2021-24830

Advanced Access Manager < 6.8.0 - Admin+ Stored Cross-Site Scripting

EPSS 0.7%CWE-79

Vexday Risk Score

3Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS —EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

23 nov 2021Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Produtos afetados

Unknown · Advanced Access Manager

Referências

https://plugins.trac.wordpress.org/changeset/2616161/https://wpscan.com/vulnerability/1c46373b-d43d-4d18-b0ae-3711fb0be0f9