CVE-2021-24597

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The You Shang WordPress plugin through 1.0.1 does not escape its qrcode links settings, which result into Stored Cross-Site Scripting issues in frontend posts and the plugins settings page depending on the payload used

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 20, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-245984.8The Testimonial WordPress plugin before 1.6.0 does not escape some testimonial fields which could allow high privilege users to perform CrosCVE-2021-245996.1The Email Encoder – Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a CVE-2021-24605.4Vulnerability in the Oracle Application Express Data Reporter component of Oracle Database Server. The supported version that is affected isCVE-2021-246004.8The WP Dialog WordPress plugin through 1.2.5.5 does not sanitise and escape some of its settings before outputting them in pages, allowing hCVE-2021-246015.4The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high CVE-2021-246028.8The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as adminCVE-2021-246035.4The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could aCVE-2021-246044.8The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post wCVE-2021-246055.4The create_post_page AJAX action of the Custom Post View Generator WordPress plugin through 0.4.6 (available to authenticated user) does notCVE-2021-246068.8The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL sCVE-2021-246074.8The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the "Footer Credit Text" added to pages, allowing higCVE-2021-246084.8The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its F
CVE-2021-24597: Medium severity, CVSS 5.4 | Vulnix