CVE-2021-24408: Prismatic < 2.8 - Contributor+ Stored XSS
The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters, allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS trigger able in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfilteredhtml capability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-24408?
The severity of CVE-2021-24408 is medium with a severity value of 5.4.
What is the affected software for CVE-2021-24408?
The affected software for CVE-2021-24408 is Plugin-planet Prismatic WordPress plugin version up to 2.8.
What is the vulnerability description of CVE-2021-24408?
CVE-2021-24408 is a vulnerability in the Prismatic WordPress plugin before 2.8 that allows users with a role as low as Contributor to set Cross-Site payload in some shortcode parameters, potentially leading to cross-site scripting (XSS) attacks.
How can I fix CVE-2021-24408?
To fix CVE-2021-24408, it is recommended to update the Prismatic WordPress plugin to version 2.8 or later.
Is there any reference available for CVE-2021-24408?
Yes, you can find more information about CVE-2021-24408 at the following link: [https://wpscan.com/vulnerability/51855853-e7bd-425f-802c-824209f4f84d](https://wpscan.com/vulnerability/51855853-e7bd-425f-802c-824209f4f84d)