CVE-2021-24496
Community Event < 1.4.8 - Reflected Cross-Site Scripting (XSS)
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 0.8%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
02 Aug 2021Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
Affected products
Unknown · Community EventsWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →