CVE-2021-24768
Last modified
CVE-2021-24768 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues.. EPSS estimates a 0.60% chance of exploitation in the next 30 days.
Description
The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wprssaggregator | Wp Rss Aggregator | < 4.19.2 |
References
- https://wpscan.com/vulnerability/3673e13f-7ce6-4d72-b179-ae4bab55514cExploit, Third Party Advisory
- https://wpscan.com/vulnerability/3673e13f-7ce6-4d72-b179-ae4bab55514cExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-24768?
How severe is CVE-2021-24768?
How do I fix CVE-2021-24768?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-24762The Perfect Survey WordPress plugin before 1.5.2 does not va…9.8
- CVE-2021-24763The Perfect Survey WordPress plugin before 1.5.2 does not ha…8.8
- CVE-2021-24764The Perfect Survey WordPress plugin before 1.5.2 does not sa…6.1
- CVE-2021-24765The Perfect Survey WordPress plugin through 1.5.2 does not v…6.1
- CVE-2021-24766The 404 to 301 – Redirect, Log and Notify 404 Errors WordPre…6.5
- CVE-2021-24767The Redirect 404 Error Page to Homepage or Custom Page with …6.5
- CVE-2021-24769The Permalink Manager Lite WordPress plugin before 2.2.13.1 …7.2
- CVE-2021-2477Vulnerability in the Oracle Applications Framework product o…5.3
- CVE-2021-24770The Stylish Price List WordPress plugin before 6.9.1 does no…6.5
- CVE-2021-24771The Inspirational Quote Rotator WordPress plugin through 1.0…4.8
- CVE-2021-24772The Stream WordPress plugin before 3.8.2 does not sanitise a…8.8
- CVE-2021-24773The WordPress Download Manager WordPress plugin before 3.2.1…4.8
Are you affected by CVE-2021-24768?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST