CVE-2021-38353

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the ~/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Dropdown and scrollable Text	Dropdown and scrollable Text	>= 2.0, <= 2.0

References

https://plugins.trac.wordpress.org/browser/dropdown-and-scrollable-text/trunk/index.php?rev=2307131#L176Exploit, Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38353Third Party Advisory
https://plugins.trac.wordpress.org/browser/dropdown-and-scrollable-text/trunk/index.php?rev=2307131#L176Exploit, Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38353Third Party Advisory

Timeline

Published: Sep 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-383546.1The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gm_error parameter found in the ~/inclu CVE-2021-383556.1The Bug Library WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the successimportcount parameter found in the ~/bug-lib CVE-2021-383566.1The NextScripts: Social Networks Auto-Poster <= 4.3.20 WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $_REQUEST['p CVE-2021-383576.1The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the ~/sms-ovh-sent.php file CVE-2021-383586.1The MoolaMojo WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the ~/views/button-generat CVE-2021-383596.1The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the CVE-2021-38365.5dbeaver is vulnerable to Improper Restriction of XML External Entity Reference CVE-2021-383609.8The wp-publications WordPress plugin is vulnerable to restrictive local file inclusion via the Q_FILE parameter found in the ~/bibtexbrowser CVE-2021-383616.1The .htaccess Redirect WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the link parameter found in the ~/htaccess-redir CVE-2021-383626.5In RSA Archer 6.x through 6.9 SP3 (6.9.3.0), an authenticated attacker can make a GET request to a REST API endpoint that is vulnerable to a CVE-2021-383637.5An issue was discovered in ONOS 2.5.1. In IntentManager, the install-requested intent (which causes an exception) remains in pendingMap (in CVE-2021-383646.5An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install or