CVE-2021-4378

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with minimal permissions like subscribers, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-437808.8Redash is a package for data visualization and sharing. In versions 10.0 and priorm the implementation of URL-loading data sources like JSON CVE-2021-437814.3Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resou CVE-2021-437827.2Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. This is a follow up to GHSA-887w-CVE-2021-437838.5@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor wit CVE-2021-437845.0runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a CVE-2021-437856.1@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL f CVE-2021-437867.5Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintenti CVE-2021-437876.1Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allow CVE-2021-437885.0Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to ac CVE-2021-437899.8PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using CVE-2021-43796.5The WooCommerce Multi Currency plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wmc_bulk_CVE-2021-437908.1Lucet is a native WebAssembly compiler and runtime. There is a bug in the main branch of `lucet-runtime` affecting all versions published to