XSS in Delicious Brains Wp Offload Ses Lite
CVE-2021-24494
The WP Offload SES Lite WordPress plugin before 1.4.5 did not escape some of the fields in the Activity page of the admin dashboard, such as the email's id, subject and recipient, which could lead to Stored Cross-Site Scripting issues when an attacker can control any of these fields, like the subject when filling a contact form for example. The XSS will be executed in the context of a logged in admin viewing the Activity tab of the plugin.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.007 (49.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- contact@wpscan.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-24494?
- CVE-2021-24494 is a medium-severity vulnerability in Delicious Brains Wp Offload Ses Lite, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2021-07-06.
- How severe is CVE-2021-24494?
- Medium severity. CVSS v3 base score is 5.4 out of 10.
- Is CVE-2021-24494 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.