CVE-2021-25048CWE-79

KingComposer <= 2.9.6 - Subscriber+ Stored Cross-Site Scripting

published April 4, 2022

CVSS
—
EPSS
1%
Percentile
50.0
In the wild
Unconfirmed
What it is

The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing any authenticated users to create arbitrary ones, with Cross-Site Scripting payloads in them

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00637 · 50.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-04-04T15:35Z
EPSS history
Timeline
  • 04 APR 15:35Z
    KingComposer <= 2.9.6 - Subscriber+ Stored Cross-Site Scripting
    cvelistv5