CVE-2021-24558

Project Status <= 1.6 - Reflected Cross-Site Scripting (XSS)

State: Published
Severity: Not scored
Published: Aug 23, 2021
Updated: Aug 3, 2024
Reserved: Jan 14, 2021

Description

The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parameter passed to it before outputting it in an error message when the related post does not exist, leading to a reflected XSS issue

Scores

The record has no CVSS score.

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
Project StatusUnknown	1.6 through 1.6Affected

References

https://wpscan.com/vulnerability/ca5f2152-fcfd-492d-a552-f9604011beff
https://codevigilant.com/disclosure/2021/wp-plugin-project-status/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.