CVE-2021-24988
Medium
Description
The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks, allowing any authenticated users, such as subscriber to call it and set a malicious payload in the addon parameter.
SeverityMedium
CVSS5.4
Exploit probability—
ProductWprssaggregator Wp Rss Aggregator
PublishedDec 27, 2021
First seenDec 27, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- wprssaggregator wp_rss_aggregator4.19.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wprssaggregator wp_rss_aggregator | v < 4.19.3 | 4.19.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.