Vulnerability · Published Aug 23, 2021 · Assigned by WPScan
CVE-2021-24558Project Status <= 1.6 - Reflected Cross-Site Scripting (XSS)
Medium 5.4
In plain English
A medium-severity cross-site scripting in Project Status from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS NVD)5.4Medium
Exploit odds (30 days)0.7%top 47.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parameter passed to it before outputting it in an error message when the related post does not exist, leading to a reflected XSS issue
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Project Status | 1.6 – through 1.6 |
Weakness: CWE-79
References
- https://wpscan.com/vulnerability/ca5f2152-fcfd-492d-a552-f9604011beff x_refsource_MISC
- https://codevigilant.com/disclosure/2021/wp-plugin-project-status/ x_refsource_MISC