Lucene search
Shweta MahajanWPEX-ID:9C315404-B66A-448C-A3B7-367A37B53435HistoryNov 15, 2021 - 12:00 a.m.
Security Audit <= 1.0.0 - Admin+ Stored Cross Site Scripting
2021-11-1500:00:00
Shweta Mahajan
35
security audit
admin
stored cross site scripting
vulnerability
exploit
EPSS
0.001
Percentile
38.3%
The plugin does not sanitise and escape the Data Id setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Put the following payload in the Data ID setting of the plugin (/wp-admin/edit.php?post_type=tlsa_audit&page=tlsa_settings) and save them: "><img src=x onerror=confirm(/XSS/)>Related
cvelist
cvelist
CVE-2021-24901 Security Audit <= 1.0.0 - Admin+ Stored Cross Site Scripting
2022-02-28 09:06:17
nvd
nvd
CVE-2021-24901
2022-02-28 09:15:08
patchstack
patchstack
packetstorm
packetstorm
WordPress Security Audit 1.0.0 Cross Site Scripting
2022-02-08 00:00:00
exploitdb
exploitdb
WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS)
2022-02-08 00:00:00
wpvulndb
wpvulndb
Security Audit <= 1.0.0 - Admin+ Stored Cross Site Scripting
2021-11-15 00:00:00
zdt
zdt
cve
cve
CVE-2021-24901
2022-02-28 09:15:08
prion
prion
Cross site scripting
2022-02-28 09:15:00