ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2021-24707

PoC —
CVSS 3.1
4.8 medium
EPSS
<1%p47
Published
()
Modified
Description

The Learning Courses WordPress plugin before 5.0 does not sanitise and escape the Email PDT identity token settings, which could allow high privilege users to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Vendors
nd-learning project
Products
nd-learning
Ecosystems
WordPress
Weakness
CWE-79
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news

No ingested article mentions this CVE yet.