CVE-2021-24980: Gwolle Guestbook < 4.2.0 - Reflected Cross-Site Scripting
Published Dec 27, 2021
·Updated
The Gwolle Guestbook WordPress plugin before 4.2.0 does not sanitise and escape the gwollegbuseremail parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in an admin page
Affected Software
1 affected component
Gwolle Guestbook Project Gwolle Guestbook Wordpress<4.2.0
Event History
Dec 27, 2021
CVE Published
via MITRE·10:33 AM
Data Sourced
via MITRE·10:33 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-24980?
The severity of CVE-2021-24980 is considered medium due to its Reflected Cross-Site Scripting nature.
2
How do I fix CVE-2021-24980?
To fix CVE-2021-24980, update the Gwolle Guestbook plugin to version 4.2.0 or later.
3
What type of vulnerability is CVE-2021-24980?
CVE-2021-24980 is a Reflected Cross-Site Scripting vulnerability.
4
Who is affected by CVE-2021-24980?
Users of the Gwolle Guestbook WordPress plugin prior to version 4.2.0 are affected by CVE-2021-24980.
5
What impact does CVE-2021-24980 have on users?
CVE-2021-24980 could allow attackers to execute arbitrary JavaScript in the context of a user's session through the admin page.