CVE-2021-24680: WP Travel Engine < 5.3.1 - Editor+ Stored Cross-Site Scripting
The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfilteredhtml capability is disallowed
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-24680?
CVE-2021-24680 has a medium severity rating due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2021-24680?
To fix CVE-2021-24680, update the WP Travel Engine plugin to version 5.3.1 or later.
Who is affected by CVE-2021-24680?
CVE-2021-24680 affects users of the WP Travel Engine plugin prior to version 5.3.1 on WordPress.
What type of attack does CVE-2021-24680 enable?
CVE-2021-24680 enables Stored Cross-Site Scripting (XSS) attacks.
What components are vulnerable in CVE-2021-24680?
CVE-2021-24680 affects the Description field in Trip Destination, Activities, Trip Type, and Pricing Category pages.