CVE-2021-24416: StreamCast < 2.1.1 - Contributor+ Stored Cross-Site Scripting
The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
Other sources
The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24416?
CVE-2021-24416 is a vulnerability in the StreamCast – Radio Player for WordPress plugin before version 2.1.1 that allows users with low privileges to inject malicious Cross-Site Scripting payloads.
What is the severity of CVE-2021-24416?
CVE-2021-24416 has a severity rating of medium with a CVSS score of 5.4.
How does CVE-2021-24416 affect the StreamCast – Radio Player for WordPress plugin?
CVE-2021-24416 affects the StreamCast – Radio Player for WordPress plugin versions before 2.1.1 by allowing users with low privileges to insert Cross-Site Scripting payloads in the plugin's shortcode parameters.
What is the CWE category for CVE-2021-24416?
CVE-2021-24416 falls into the CWE category 79, which is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
How can I fix CVE-2021-24416?
To fix CVE-2021-24416, update the StreamCast – Radio Player for WordPress plugin to version 2.1.1 or later.