What is CVE-2021-24545?

CVE-2021-24545 is a medium-severity vulnerability in Wp HTML Author Bio Project, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2021-10-11.

How severe is CVE-2021-24545?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Is CVE-2021-24545 known to be exploited?

10 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Wp HTML Author Bio Project

CVE-2021-24545

The WP HTML Author Bio WordPress plugin through 1.2.0 does not sanitise the HTML allowed in the Bio of users, allowing them to use malicious JavaScript code, which will be executed when anyone visit a post in the frontend made by such user. As a result, user with a role as low as author could perform Cross-Site Scripting attacks against users, which could potentially lead to privilege escalation when an admin view the related post/s.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.018 (76.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Wp_html_author_bio_project Wp_html_author_bio
Unknown Wp Html Author Bio — versions 1.2.0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

References

contact@wpscan.com (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-24545?: CVE-2021-24545 is a medium-severity vulnerability in Wp HTML Author Bio Project, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2021-10-11.
How severe is CVE-2021-24545?: Medium severity. CVSS v3 base score is 5.4 out of 10.
Is CVE-2021-24545 known to be exploited?: 10 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.