The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/41d9027c-a982-44c7-889e-721333496b5c | Exploit Third Party Advisory |
https://wpscan.com/vulnerability/41d9027c-a982-44c7-889e-721333496b5c | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:53
Type | Values Removed | Values Added |
---|---|---|
References | () https://wpscan.com/vulnerability/41d9027c-a982-44c7-889e-721333496b5c - Exploit, Third Party Advisory |
23 Sep 2021, 14:26
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 4.8 |
CPE | cpe:2.3:a:ticket-system:wordpress_advanced_ticket_system:*:*:*:*:*:wordpress:*:* | |
References | (MISC) https://wpscan.com/vulnerability/41d9027c-a982-44c7-889e-721333496b5c - Exploit, Third Party Advisory |
13 Sep 2021, 18:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-09-13 18:15
Updated : 2024-11-21 05:53
NVD link : CVE-2021-24623
Mitre link : CVE-2021-24623
CVE.ORG link : CVE-2021-24623
JSON object : View
Products Affected
ticket-system
- wordpress_advanced_ticket_system
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')