CVE-2021-24129

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
5.4MEDIUM
EPSS
0.2%
top 62.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Themify Portfolio PostThemify Portfolio Post
Timeline
PublishedMar 18
Latest updateMay 24

Description

Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS) vulnerabilities allowing low-privileged users (Contributor+) to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Panel is embedded, which could lead to privilege escalation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/themify_portfolio_post1.1.6 — 1.1.6

🔴Vulnerability Details

2
GHSA
GHSA-mv99-79gw-2g8g: Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1↗2022-05-24
▶
CVEList
Themify Portfolio Post < 1.1.6 - Authenticated Stored Cross-Site Scripting↗2021-03-18
▶