CVE-2021-24290

Published: May 17, 2021Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages.

Affected (1)

Products: De Baat: Store Locator Plus

De Baat

1 product

Store Locator Plus

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
De Baat Store Locator Plus	Up to 5.5.15

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://wpscan.com/vulnerability/dc368484-f2fe-4c76-ba3d-e00e7f633719

Source: contact@wpscan.com

Third Party Advisory

https://www.wordfence.com/blog/2021/04/severe-unpatched-vulnerabilities-leads-to-closure-of-store-locator-plus-plugin

Source: contact@wpscan.com

Third Party Advisory

https://wpscan.com/vulnerability/dc368484-f2fe-4c76-ba3d-e00e7f633719

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.wordfence.com/blog/2021/04/severe-unpatched-vulnerabilities-leads-to-closure-of-store-locator-plus-plugin

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.