Store Locator Plus <= 5.5.15 - Unauthenticated Stored Cross-Site Scripting (XSS)
CVE-2021-24290

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Store Locator Plus For WordPress
Vendor
CVE Published:
17 May 2021

What is CVE-2021-24290?

There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Store Locator Plus for WordPress 5.5.15

References

https://wpscan.com/vulnerability/dc368484-f2fe-4c76-ba3d-...
x_refsource_CONFIRM
https://www.wordfence.com/blog/2021/04/severe-unpatched-v...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chloe Chamberland
JSON
.