CVE-2021-24445
My Site Audit <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS)
- State
- Published
- Severity
- Not scored
- Published
- Aug 16, 2021
- Updated
- Aug 3, 2024
- Reserved
- Jan 14, 2021
Description
The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Scores
The record has no CVSS score.
Weaknesses
- CWE-79 Cross-site Scripting (XSS)
Affected Products
| Product | Versions |
|---|---|
My Site AuditUnknown |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.