CVE-2021-24494
Medium
Description
The WP Offload SES Lite WordPress plugin before 1.4.5 did not escape some of the fields in the Activity page of the admin dashboard, such as the email's id, subject and recipient, which could lead to Stored Cross-Site Scripting issues when an attacker can control any of these fields, like the subject when filling a contact form for example. The XSS will be executed in the context of a logged in admin viewing the Activity tab of the plugin.
SeverityMedium
CVSS5.4
Exploit probability—
ProductDeliciousbrains Wp Offload Ses Lite
PublishedJul 6, 2021
First seenJul 6, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- deliciousbrains wp_offload_ses_lite1.4.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| deliciousbrains wp_offload_ses_lite | v < 1.4.5 | 1.4.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.