CVE-2021-24366: Admin Columns Free < 4.3 & Pro < 5.5.1 - Admin+ Stored XSS in Label
The Admin Columns Free WordPress plugin before 4.3 and Admin Columns Pro WordPress plugin before 5.5.1, rendered input on the posted pages with improper input validation on the value passed into the field 'Label' parameter, by taking this as an advantage an authenticated attacker can supply a crafted arbitrary script and execute it.
Other sources
The Admin Columns WordPress plugin before 4.3 and Admin Columns Pro WordPress plugin before 5.5.1 do not sanitise and escape its Label settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this security issue?
The vulnerability ID for this security issue is CVE-2021-24366.
Which plugins are affected by this vulnerability?
The Admin Columns Free WordPress plugin before 4.3 and Admin Columns Pro WordPress plugin before 5.5.1 are affected by this vulnerability.
What is the severity of CVE-2021-24366?
The severity of CVE-2021-24366 is medium.
How can an authenticated attacker exploit this vulnerability?
An authenticated attacker can exploit this vulnerability by supplying a crafted value in the 'Label' parameter of a posted page.
Are there any references for this vulnerability?
Yes, you can refer to the following sources for more information: - [WPScan](https://wpscan.com/vulnerability/05427156-4d5c-4aeb-add8-1c574fda5c28) - [WhiteSource Software](https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-24366)