CVE-2021-24765

Perfect Survey < 1.5.2 - Unauthenticated Stored Cross-Site Scripting

published February 1, 2022

CVSS
—
EPSS
1%
Percentile
72.4
In the wild
Unconfirmed
What it is

The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01405 · 72.4th percentile
Published
2022-02-01T12:21Z
EPSS history
Timeline
  • 01 FEB 12:21Z
    Perfect Survey < 1.5.2 - Unauthenticated Stored Cross-Site Scripting
    cvelistv5