Vulnerability · Published Aug 23, 2021 · Assigned by WPScan

CVE-2021-24561WP SMS < 5.4.13 - Authenticated Stored Cross-Site Scripting

Medium 5.4

In plain English

A medium-severity cross-site scripting in WP SMS from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS NVD)5.4Medium

Exploit odds (30 days)0.7%top 47.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" page, leading to an Authenticated Stored Cross-Site Scripting issue

Affected products (as reported)

Vendor	Product	Versions
Unknown	WP SMS	5.4.13 – before 5.4.13

Weakness: CWE-79

References

https://wpscan.com/vulnerability/5433ef4c-4451-4b6e-992b-69c5eccabf90 x_refsource_MISC
https://plugins.trac.wordpress.org/changeset/2570762/wp-sms x_refsource_CONFIRM