blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24558

MEDIUM 5.4 CVSS 3.1
Published
August 23, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parameter passed to it before outputting it in an error message when the related post does not exist, leading to a reflected XSS issue

Affected products and versions

  • Unknown Project Status — From 1.6 (including) to 1.6 (including)
  • 3.7designs project_status — Up to and including 1.6

References

  • codevigilant.com https://codevigilant.com/disclosure/2021/wp-plugin-project-status/ Exploit, Third Party Advisory
  • wpscan.com https://wpscan.com/vulnerability/ca5f2152-fcfd-492d-a552-f9604011beff Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record