CVE Daily

CVE-2021-24211

The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admi...

Medium CVSS 5.4

Overview

The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page. By exploiting that an attacker will be able to execute JavaScript code in the user's browser.

CWE: CWE-79 Published: 2021-04-05T19:15:17.530
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 5.4 (MEDIUM)
  • Detected tags: stored_xss, wordpress, xss (tag impact: MODERATE)

Recommended actions:

  • Sanitize stored input and enforce CSP.
  • Apply context-aware output encoding.
  • Enable Content-Security-Policy and HttpOnly/SameSite cookies.

Recommended tools

Tags