CVE-2021-24561: WP SMS < 5.4.13 - Authenticated Stored Cross-Site Scripting
Published Aug 23, 2021
·Updated
The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wpgroupname" parameter before outputting it back in the "Groups" page, leading to an Authenticated Stored Cross-Site Scripting issue
Affected Software
2 affected components
VeronaLabs Wp Sms Wordpress<5.4.13
VeronaLabs Wp Sms Wordpress<5.4.13
Event History
Aug 23, 2021
CVE Published
via MITRE·11:10 AM
Data Sourced
via MITRE·11:10 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-24561?
The severity of CVE-2021-24561 is considered medium due to its potential for exploitation via authenticated users.
2
How do I fix CVE-2021-24561?
To fix CVE-2021-24561, update the WP SMS plugin to version 5.4.13 or later.
3
What kind of vulnerability is CVE-2021-24561?
CVE-2021-24561 is an Authenticated Stored Cross-Site Scripting vulnerability.
4
What is the impact of CVE-2021-24561 on websites?
The impact of CVE-2021-24561 may allow attackers to execute malicious scripts in the context of user sessions on vulnerable sites.
5
Who is affected by CVE-2021-24561?
CVE-2021-24561 affects installations of the WP SMS plugin prior to version 5.4.13.