CVE-2021-24409

MEDIUM NUCLEI

Prismatic < 2.8 - Reflected Cross-Site Scripting via Tab GET Parameter

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2021-24409 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator

Nuclei Templates (1)

Prismatic < 2.8 - Cross-Site Scripting
MEDIUMVERIFIEDby Harsh
Shodan: http.html:/wp-content/plugins/prismatic
FOFA: body=/wp-content/plugins/prismatic

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_confirm
https://wpscan.com/vulnerability/ae3cd3ed-aecd-4d8c-8a2b-2936aaaef0cf

Scores

CVSS v3 6.1
EPSS 0.0179
EPSS Percentile 75.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
plugin-planet/prismatic < 2.8
Published Jul 12, 2021
Tracked Since Feb 18, 2026