First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2021-24745

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Unknown	About Author Box	>= 1.0.2, < 1.0.2

References

https://wpscan.com/vulnerability/a965aeca-d8f9-4070-aa0d-9c9b95493ddaExploit, Third Party Advisory
https://wpscan.com/vulnerability/a965aeca-d8f9-4070-aa0d-9c9b95493ddaExploit, Third Party Advisory

Timeline

Published: Nov 29, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-247466.1The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes CVE-2021-247477.2The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX request as CVE-2021-247488.8The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before usin CVE-2021-247494.3The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attac CVE-2021-24754.4Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prio CVE-2021-247508.8The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails CVE-2021-247515.4The GenerateBlocks WordPress plugin before 1.4.0 does not validate the generateblocks/container block's tagName attribute, which could allow CVE-2021-247525.7Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any CVE-2021-247537.2The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page CVE-2021-247547.2The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it in a SQL statement CVE-2021-247558.8The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQ CVE-2021-247566.1The WP System Log WordPress plugin before 1.0.21 does not sanitise, validate and escape the IP address retrieved from login requests before