CVE-2021-24178: vulnerability in Business Directory Plugin – Easy Listing…
Business Directory Plugin < 5.11.1 - Arbitrary Add/Edit/Delete Form Field to Stored XSS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.7%
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 suffered from Cross-Site Request Forgery issues, allowing an attacker to make a logged in administrator add, edit or delete form fields, which could also lead to Stored Cross-Site Scripting issues.
Affected products
Business Directory Team · Business Directory Plugin – Easy Listing Directories for WordPressRelated CVEs — Business Directory Plugin – Easy Listing…
In the same product, most dangerous first.
CVE-2021-24248—Business Directory Plugin < 5.11.1 - Authenticated PHP4 Upload to RCEEPSS 1.6%CVE-2021-24249—Business Directory Plugin < 5.11.2 - Arbitrary Listing ExportEPSS 0.7%CVE-2021-24179—Business Directory Plugin < 5.11 - Arbitrary File Upload to RCEEPSS 0.7%CVE-2021-24250—Business Directory Plugin < 5.11.2 - Authenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-24251—Business Directory Plugin < 5.11.2 - Arbitrary Payment History UpdateEPSS 0.5%CVE-2023-5803MEDIUMWordPress Business Directory Plugin Plugin <= 6.3.10 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%