CVE-2021-24287

medium · 6.1

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue

6.1

CVSS

10.4%

EPSS (exploit prob.)

96th

EPSS percentile

2021-05-14

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-79

Affected products

Vendor	Product	Affected versions
mooveagency	select_all_categories_and_taxonomies,_change_checkbox_to_radio_buttons	< 1.3.2

Check a specific version with /api/v1/cve/match.

References

http://packetstormsecurity.com/files/164327/WordPress-Select-All-Categories-And-Taxonomies-1.3.1-Cross-Site-Scripting.html
https://wpscan.com/vulnerability/56e1bb56-bfc5-40dd-b2d0-edef43d89bdf
http://packetstormsecurity.com/files/164327/WordPress-Select-All-Categories-And-Taxonomies-1.3.1-Cross-Site-Scripting.html
https://wpscan.com/vulnerability/56e1bb56-bfc5-40dd-b2d0-edef43d89bdf

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-24287