Lucene search
WPScanCVELIST:CVE-2021-24714HistoryDec 06, 2021 - 3:55 p.m.
CVE-2021-24714 WP All Import < 3.6.3 - Admin+ Stored Cross-Site Scripting
2021-12-0615:55:23
CWE-79
WPScan
www.cve.org
2
cve-2021-24714
wp all import
admin
stored
cross-site scripting
xml
csv
wordpress
plugin
security
vulnerability
unfiltered html
EPSS
0.001
Percentile
24.8%
The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import’s Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfiltered_html capability is disallowed.
CNA Affected
[
{
"product": "Import any XML or CSV File to WordPress",
"vendor": "Unknown",
"versions": [
{
"lessThan": "3.6.3",
"status": "affected",
"version": "3.6.3",
"versionType": "custom"
}
]
}
]Related
nvd
nvd
CVE-2021-24714
2021-12-06 16:15:07
wpexploit
wpexploit
WP All Import < 3.6.3 - Admin+ Stored Cross-Site Scripting
2021-11-02 00:00:00
prion
prion
Cross site scripting
2021-12-06 16:15:00
cve
cve
CVE-2021-24714
2021-12-06 16:15:07
wpvulndb
wpvulndb
WP All Import < 3.6.3 - Admin+ Stored Cross-Site Scripting
2021-11-02 00:00:00