CVE-2021-24734

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
5.4MEDIUM
EPSS
0.2%
top 60.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Compact WP Audio PlayerTipsandtricks-hq Compact WP Audio Player
Timeline
PublishedOct 18
Latest updateMay 24

Description

The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/compact_wp_audio_player1.9.7 — 1.9.7

🔴Vulnerability Details

2
GHSA
GHSA-mc96-xvr9-9pqc: The Compact WP Audio Player WordPress plugin before 1↗2022-05-24
▶
CVEList
Compact WP Audio Player < 1.9.7 - Contributor+ Stored Cross-Site Scripting↗2021-10-18
▶