CVE-2021-24904

MEDIUM

Mortgage Calculators WP < 1.56 - Admin+ Stored Cross-Site Scripting

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-24904 has a selected CVSS score of 4.8 (medium); EIP currently links 1 catalogued exploit.

Description

The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Affected products and versions

1
ProductSourceVersion range

Mortgage Calculators WP

CVE List1.56 to < 1.56affected

Proofs of concept

1

Catalogued exploits

ExploitDBWordPress Plugin Mortgage Calculators WP 1.52 - Stored Cross-Site Scripting (XSS) (Authenticated)ExploitDB exploitby Ceylan BOZOĞULLARINDANNot analyzed1 file
ExploitDB
PoC details

References

2