CVE-2021-24290: Store Locator Plus <= 5.5.15 - Unauthenticated Stored Cross-Site Scripting (XSS)
Published May 17, 2021
·Updated
There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages.
Affected Software
1 affected component
De-baat Store Locator Plus Wordpress<=5.5.15
Event History
May 17, 2021
CVE Published
via MITRE·04:48 PM
Data Sourced
via MITRE·04:48 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-24290?
The severity of CVE-2021-24290 is considered high due to its potential for allowing unauthenticated attackers to inject malicious JavaScript.
2
How do I fix CVE-2021-24290?
To fix CVE-2021-24290, update the Store Locator Plus plugin to a version later than 5.5.15.
3
Which versions of Store Locator Plus are affected by CVE-2021-24290?
CVE-2021-24290 affects all versions of the Store Locator Plus plugin up to and including version 5.5.15.
4
What types of attacks can exploit CVE-2021-24290?
CVE-2021-24290 can be exploited for cross-site scripting (XSS) attacks due to the ability to inject malicious JavaScript.
5
Is authentication required to exploit CVE-2021-24290?
No, CVE-2021-24290 can be exploited by unauthenticated attackers.