CVE-2021-24773

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them, allowing high privilege users to perform XSS attacks even when the unfiltered_html capability is disallowed

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Nov 1, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-247747.2The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them CVE-2021-247755.3The Document Embedder WordPress plugin before 1.7.5 contains a REST endpoint, which could allow unauthenticated users to enumerate the titleCVE-2021-247764.3The WP Performance Score Booster WordPress plugin before 2.1 does not have CSRF check when saving its settings, which could allow attackers CVE-2021-247777.2The view submission functionality in the Hotscot Contact Form WordPress plugin before 1.3 makes a get request with the sub_id parameter whicCVE-2021-247787.2The test parameter of the xmlfeed in the Tradetracker-Store WordPress plugin before 4.6.60 is not sanitised, escaped or validated before insCVE-2021-247796.5The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation andCVE-2021-24784.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.26 and prioCVE-2021-247804.3The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to mCVE-2021-247814.3The Image Source Control WordPress plugin before 2.3.1 allows users with a role as low as Contributor to change arbitrary post meta fields oCVE-2021-247824.8The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could allow hight privileCVE-2021-247836.5The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as lowCVE-2021-247846.5The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to mak
CVE-2021-24773: Medium severity, CVSS 4.8 | Vulnix