blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24974

MEDIUM 5.4 CVSS 3.1
Published
January 24, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

The Product Feed PRO for WooCommerce WordPress plugin before 11.0.7 does not have authorisation and CSRF check in some of its AJAX actions, allowing any authenticated users to call then, which could lead to Stored Cross-Site Scripting issue (which will be triggered in the admin dashboard) due to the lack of escaping.

Affected products and versions

  • Unknown Product Feed PRO for WooCommerce — From 11.0.7 (including) to 11.0.7 (excluding)
  • adtribes product_feed_pro_for_woocommerce — Before 11.0.7

References

  • wpscan.com https://wpscan.com/vulnerability/8ed549fe-7d27-4a7a-b226-c20252964b29 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record