CVE-2021-24494: WP Offload SES Lite < 1.4.5 - Stored Cross-Site Scripting (XSS)
The WP Offload SES Lite WordPress plugin before 1.4.5 did not escape some of the fields in the Activity page of the admin dashboard, such as the email's id, subject and recipient, which could lead to Stored Cross-Site Scripting issues when an attacker can control any of these fields, like the subject when filling a contact form for example. The XSS will be executed in the context of a logged in admin viewing the Activity tab of the plugin.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-24494?
CVE-2021-24494 is considered a medium severity vulnerability due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2021-24494?
To fix CVE-2021-24494, update the WP Offload SES Lite plugin to version 1.4.5 or later.
What specific issues does CVE-2021-24494 cause?
CVE-2021-24494 allows attackers to exploit unescaped fields in the Activity page of the WordPress admin dashboard, leading to Stored Cross-Site Scripting.
Which versions of WP Offload SES Lite are affected by CVE-2021-24494?
CVE-2021-24494 affects versions of WP Offload SES Lite prior to 1.4.5.
Is user input involved in CVE-2021-24494?
Yes, user-controlled input in the admin dashboard fields is involved in CVE-2021-24494, making it susceptible to attacks.