CVE-2021-24305CWE-79

CVE-2021-24305: fallo en TargetFirst Target First Plugin

Target First Plugin 2.0 - Unauthenticated Stored XSS via Licence Key

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Target First Plugin

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 1.2%
The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the 'weeWzKey' parameter that will be save as the 'weeID option and is not sanitized.
Productos afectados
TargetFirst · Target First Plugin