CVE-2021-24464 YouTube Embed, Playlist and Popup < 2.3.9 - Contributor+ Stored XSS

2021-08-0210:32:10

CWE-79

WPScan

www.cve.org

cve-2021-24464

youtube

embed

playlist

popup

wpdevart

wordpress

xss

stored cross-site scripting

EPSS

0.001

Percentile

24.8%

JSON

The YouTube Embed, Playlist and Popup by WpDevArt WordPress plugin before 2.3.9 did not escape, validate or sanitise some of its shortcode options, available to users with a role as low as Contributor, leading to an authenticated Stored Cross-Site Scripting issue.

CNA Affected

[
  {
    "product": "YouTube Embed, Playlist and Popup by WpDevArt",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.3.9",
        "status": "affected",
        "version": "2.3.9",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/531b3fac-48b9-4821-a3aa-4db073d43aae

EPSS

0.001

Percentile

24.8%

JSON

Related for CVELIST:CVE-2021-24464