CVE-2021-24304: Newsmag < 5.0 - Unauthenticated Reflected Cross-site Scripting (XSS)
Published Aug 9, 2021
·Updated
The Newsmag WordPress theme before 5.0 does not sanitise the tdblockid parameter in its tdajaxblock AJAX action, leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability.
Affected Software
1 affected component
tagDiv Newsmag Wordpress<5.0
Event History
Aug 9, 2021
CVE Published
via MITRE·10:04 AM
Data Sourced
via MITRE·10:04 AM
DescriptionWeakness
Frequently Asked Questions
1
What is CVE-2021-24304?
CVE-2021-24304 is a vulnerability found in the Newsmag WordPress theme before version 5.0.
2
What is the severity of CVE-2021-24304?
CVE-2021-24304 has a severity of medium with a CVSS score of 6.1.
3
What is the affected software for CVE-2021-24304?
The affected software for CVE-2021-24304 is the Tagdiv Newsmag WordPress theme up to version 5.0.
4
What is the CWE for CVE-2021-24304?
The CWE for CVE-2021-24304 is CWE-79, which stands for Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
5
How can I fix CVE-2021-24304?
To fix CVE-2021-24304, update the Newsmag WordPress theme to version 5.0 or higher.