CVE-2021-24605

Published: Sep 13, 2021Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

The create_post_page AJAX action of the Custom Post View Generator WordPress plugin through 0.4.6 (available to authenticated user) does not sanitise or escape user input before outputting it back in the response, leading to a Reflected Cross-Site issue

Affected (1)

Products: Custom Post View Generator Project: Custom Post View Generator

Custom Post View Generator Project

1 product

Custom Post View Generator

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Custom Post View Generator Project Custom Post View Generator	Up to 0.4.6

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://wpscan.com/vulnerability/e0be384c-3e63-49f6-b2ab-3024dcd88686

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/e0be384c-3e63-49f6-b2ab-3024dcd88686

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.