Lucene search
WPScanCVELIST:CVE-2021-24509HistoryAug 09, 2021 - 10:04 a.m.
CVE-2021-24509 Page View Counts < 2.4.9 - Contributor+ Stored XSS
2021-08-0910:04:13
CWE-79
WPScan
www.cve.org
1
wordpress
plugin
stored xss
postid parameter
contributor
admin
frontend
editor
unfiltered_html
EPSS
0.001
Percentile
24.8%
The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvc_stats shortcode, allowing users with a role as low as Contributor to perform Stored XSS attacks. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.
CNA Affected
[
{
"product": "Page View Count",
"vendor": "Unknown",
"versions": [
{
"lessThan": "2.4.9",
"status": "affected",
"version": "2.4.9",
"versionType": "custom"
}
]
}
]Related
cnvd
cnvd
WordPress Cross-Site Scripting Vulnerability (CNVD-2021-61431)
2021-08-11 00:00:00
patchstack
patchstack
prion
prion
Cross site scripting
2021-08-09 10:15:00
nvd
nvd
CVE-2021-24509
2021-08-09 10:15:07
wpvulndb
wpvulndb
Page View Counts < 2.4.9 - Contributor+ Stored XSS
2021-07-12 00:00:00
wpexploit
wpexploit
Page View Counts < 2.4.9 - Contributor+ Stored XSS
2021-07-12 00:00:00
cve
cve
CVE-2021-24509
2021-08-09 10:15:07