blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24494

MEDIUM 5.4 CVSS 3.1
Published
July 6, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

The WP Offload SES Lite WordPress plugin before 1.4.5 did not escape some of the fields in the Activity page of the admin dashboard, such as the email's id, subject and recipient, which could lead to Stored Cross-Site Scripting issues when an attacker can control any of these fields, like the subject when filling a contact form for example. The XSS will be executed in the context of a logged in admin viewing the Activity tab of the plugin.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Delicious Brains WP Offload SES Lite — From 1.4.5 (including) to 1.4.5 (excluding)
  • deliciousbrains wp_offload_ses_lite — Before 1.4.5

References

  • wpscan.com https://wpscan.com/vulnerability/8f14733e-84c3-4f7c-93f8-e27c74519160 Exploit, Vendor Advisory
  • nvd.nist.gov Official NVD record