CVE-2021-24519: Vik Rent Car < 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS)
The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the 'Text Next to Icon' field when adding or editing a Characteristic, allowing high privilege users such as admin to use XSS payload in it, leading to an authenticated Stored Cross-Site Scripting issue
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24519?
CVE-2021-24519 is a vulnerability in the VikRentCar Car Rental Management System WordPress plugin before version 1.1.10 that allows high privilege users to inject XSS payload through the 'Text Next to Icon' field, leading to an authenticated Stored Cross-Site Scripting issue.
How severe is CVE-2021-24519?
CVE-2021-24519 has a severity rating of 4.8 out of 10, which is considered medium.
What software versions are affected by CVE-2021-24519?
The VikRentCar Car Rental Management System WordPress plugin versions up to, but excluding, 1.1.10 are affected by CVE-2021-24519.
How can I fix CVE-2021-24519?
To fix CVE-2021-24519, you should update the VikRentCar Car Rental Management System WordPress plugin to version 1.1.10 or newer.
What is the Common Weakness Enumeration (CWE) ID for CVE-2021-24519?
The CWE ID for CVE-2021-24519 is CWE-79, which represents Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').