CVE-2021-24464: YouTube Embed, Playlist and Popup < 2.3.9 - Contributor+ Stored XSS
The YouTube Embed, Playlist and Popup by WpDevArt WordPress plugin before 2.3.9 did not escape, validate or sanitise some of its shortcode options, available to users with a role as low as Contributor, leading to an authenticated Stored Cross-Site Scripting issue.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-24464.
What is the severity level of CVE-2021-24464?
The severity level of CVE-2021-24464 is medium with a severity value of 5.4.
What is the affected software for CVE-2021-24464?
The affected software for CVE-2021-24464 is the YouTube Embed, Playlist and Popup by WpDevArt WordPress plugin version up to and exclusive to 2.3.9.
Who is affected by CVE-2021-24464?
Users with a role as low as Contributor are affected by CVE-2021-24464.
What is the vulnerability category of CVE-2021-24464?
CVE-2021-24464 is categorized as an authenticated Stored Cross-Site Scripting issue.
Is there a reference link for more information about CVE-2021-24464?
Yes, you can find more information about CVE-2021-24464 at https://wpscan.com/vulnerability/531b3fac-48b9-4821-a3aa-4db073d43aae.