CVE-2021-24421

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
5.4MEDIUM
EPSS
0.2%
top 60.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown WP JobsearchEyecix Jobsearch WP JOB Board
Timeline
PublishedJul 12
Latest updateMay 24

Description

The WP JobSearch WordPress plugin before 1.7.4 did not sanitise or escape multiple of its parameters from the my-resume page before outputting them in the page, allowing low privilege users to use JavaScript payloads in them and leading to a Stored Cross-Site Scripting issue

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/wp_jobsearch1.7.4 — 1.7.4

🔴Vulnerability Details

2
GHSA
GHSA-q4j4-vw28-779r: The WP JobSearch WordPress plugin before 1↗2022-05-24
▶
CVEList
WP JobSearch < 1.7.4 - Authenticated Stored XSS↗2021-07-12
▶
CVE-2021-24421 (MEDIUM CVSS 5.4) | The WP JobSearch WordPress plugin b | cvebase.io