CVE-2021-24560: Software License Manager < 4.4.8 - Reflected Cross-Site Scripting
The Software License Manager WordPress plugin before 4.4.8 does not sanitise or escape the editrecord parameter before outputting it back in the page in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24560?
CVE-2021-24560 is a vulnerability in the Software License Manager WordPress plugin before version 4.4.8 that allows for Reflected Cross-Site Scripting (XSS).
How severe is CVE-2021-24560?
CVE-2021-24560 has a severity level of medium with a score of 6.1 (out of 10).
How does CVE-2021-24560 affect the Software License Manager WordPress plugin?
CVE-2021-24560 affects the Software License Manager WordPress plugin before version 4.4.8, allowing for Reflected Cross-Site Scripting (XSS) attacks.
Is there a fix available for CVE-2021-24560?
Yes, upgrading to version 4.4.8 of the Software License Manager WordPress plugin fixes the vulnerability.
What is CWE-79?
CWE-79 is a common weakness enumeration category that refers to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').