PT-2024-10892 · WordPress · The Simple Post

Vikas Srivastava · Published 2024-01-16 · Updated 2024-08-29 · CVE-2021-24567

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Simple Post WordPress plugin versions through 1.1

Description The issue arises from the plugin's failure to sanitize user input when an authenticated user provides a Text value. As a result, these values are not escaped when outputted to the browser, leading to an Authenticated Stored XSS Cross-Site Scripting issue.

Recommendations For The Simple Post WordPress plugin versions through 1.1, update to a version that addresses this issue, as the current version does not properly sanitize user input, leading to potential XSS attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24567

Affected Products

The Simple Post

References · 4

• 🔥 https://wpscan.com/vulnerability/a3cd3115-2181-4e14-8b39-4de096433847 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24567 · Security Note
• https://twitter.com/CVEnew/status/1747293187469946986 · Twitter Post