CVE-2021-24246CWE-79

CVE-2021-24246: vulnerability in PureThemes WorkScout

WorkScout Core < 1.3.4 - Authenticated Stored XSS & XFS

Published · Updated

Follow this CVE+ Monitor WorkScout-Core+ Monitor WorkScout

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.7%
The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX action, leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues
Affected products
PureThemes · WorkScoutPureThemes · Workscout Core