Riskcovery

CVE-2021-24897

Add Subtitle <= 1.1.0 - Contributor+ Stored Cross-Site Scripting

State
Published
Severity
Not scored
Published
Mar 14, 2022
Updated
Aug 3, 2024
Reserved
Jan 14, 2021

Read the record on cve.org

Description

The Add Subtitle WordPress plugin through 1.1.0 does not sanitise or escape the sub-title field (available only with classic editor) when output in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks

Scores

The record has no CVSS score.

Weaknesses

  • CWE-79 Cross-site Scripting (XSS)

Affected Products

ProductVersions
Add SubtitleUnknown
  • 1.1.0 through 1.1.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.