CVE-2021-24826CWE-79

Custom Content Shortcode < 4.0.2 - Authenticated Stored Cross-Site Scripting

published March 7, 2022

CVSS
—
EPSS
1%
Percentile
48.2
In the wild
Unconfirmed
What it is

The Custom Content Shortcode WordPress plugin before 4.0.2 does not escape custom fields before outputting them, which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed. Please note that such attack is still possible by admin+ in single site blogs by default (but won't be when the unfiltered_html is disallowed)

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00604 · 48.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-03-07T08:16Z
EPSS history
Timeline
  • 07 MAR 08:16Z
    Custom Content Shortcode < 4.0.2 - Authenticated Stored Cross-Site Scripting
    cvelistv5