CVE-2021-24153

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blacklisting Parenthesis as well as several functions such as alert but bypasses were found.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Yoast SEO	>= 3.4.1, < 3.4.1

References

https://packetstormsecurity.com/files/138192/Exploit, Third Party Advisory, VDB Entry
https://plugins.trac.wordpress.org/changeset/1466243/wordpress-seoThird Party Advisory
https://wpscan.com/vulnerability/77810044-394d-4314-b9a1-20c7dca726dcThird Party Advisory
https://packetstormsecurity.com/files/138192/Exploit, Third Party Advisory, VDB Entry
https://plugins.trac.wordpress.org/changeset/1466243/wordpress-seoThird Party Advisory
https://wpscan.com/vulnerability/77810044-394d-4314-b9a1-20c7dca726dcThird Party Advisory

Timeline

Published: Apr 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-241544.9The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allo CVE-2021-241557.2The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP CVE-2021-241565.4Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaSc CVE-2021-241575.4Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. There were no checks to verify that a CVE-2021-241586.5Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As par CVE-2021-241598.8Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject maliciou CVE-2021-24164.9Vulnerability in the Oracle Communications Session Border Controller product of Oracle Communications (component: Routing). Supported versio CVE-2021-241608.8In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files th CVE-2021-241618.8In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploadi CVE-2021-241628.8In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importi CVE-2021-241638.8The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protect CVE-2021-241644.3In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_