CVE-2021-24592

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Sitewide Notice WP WordPress plugin before 2.3 does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownSitewide Notice WP>= 2.3, < 2.3

References

Timeline

Published
Aug 30, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-245935.4The Business Hours Indicator WordPress plugin before 2.3.5 does not sanitise or escape its 'Now closed message" setting when outputting it iCVE-2021-245944.8The Translate WordPress – Google Language Translator WordPress plugin before 6.0.12 does not sanitise and escape some of its settings beforeCVE-2021-245956.5The Wp Cookie Choice WordPress plugin through 1.1.0 is lacking any CSRF check when saving its options, and do not escape them when outputtinCVE-2021-245964.8The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowing high privilege useCVE-2021-245975.4The You Shang WordPress plugin through 1.0.1 does not escape its qrcode links settings, which result into Stored Cross-Site Scripting issuesCVE-2021-245984.8The Testimonial WordPress plugin before 1.6.0 does not escape some testimonial fields which could allow high privilege users to perform CrosCVE-2021-245996.1The Email Encoder – Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a CVE-2021-24605.4Vulnerability in the Oracle Application Express Data Reporter component of Oracle Database Server. The supported version that is affected isCVE-2021-246004.8The WP Dialog WordPress plugin through 1.2.5.5 does not sanitise and escape some of its settings before outputting them in pages, allowing hCVE-2021-246015.4The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high CVE-2021-246028.8The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as adminCVE-2021-246035.4The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could a