CVE-2021-24518
Medium
Description
The WPFront Notification Bar WordPress plugin before 2.0.0.07176 does not sanitise or escape its Custom CSS setting, allowing high privilege users such as admin to set XSS payload in it even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
SeverityMedium
CVSS4.8
Exploit probability—
ProductWpfront Notification Bar
PublishedAug 16, 2021
First seenAug 16, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- wpfront notification_bar2.0.0.07176 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wpfront notification_bar | v < 2.0.0.07176 | 2.0.0.07176 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.