CVE-2021-24713CWE-79cross-site-scripting

CVE-2021-24713

Medium · published November 24, 2021

CVSS v3.1
4.8
EPSS
1%
Percentile
48.9
In the wild
Unconfirmed
What it is

The Video Lessons Manager WordPress plugin before 1.7.2 and Video Lessons Manager Pro WordPress plugin before 3.5.9 do not properly sanitize and escape values when updating their settings, which could allow high privilege users to perform Cross-Site Scripting attacks

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00617 · 48.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-11-24T01:15Z
Affected products (1)
ProductVersionsFixed in
cminds/video_lessons_manager< 1.7.21.7.2
References (2)
https://wpscan.com/vulnerability/4a90be69-41eb-43e9-962d-34316497b4df · [email protected]https://wpscan.com/vulnerability/4a90be69-41eb-43e9-962d-34316497b4df · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 23 NOV 19:16Z
    Video Lessons Manager - Admin+ Stored Cross-Site Scripting
    cvelistv5