« Volver al listado

CVE-2021-24444

Estado: ModificadaMedia (4.8)—💥 Exploit

El plugin de WordPress TaxoPress - Create and Manage Taxonomies, Tags, Categories antes de la versión 3.0.7.2 no sanea su campo de descripción de la taxonomía, lo que permite a los usuarios con privilegios elevados establecer la carga útil de JavaScript en ellos incluso cuando la capacidad unfiltered_html no está permitida, lo que conduce a un problema de Cross-Site Scripting almacenado autenticado

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Taxopress — Taxopress

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-24444",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "TaxoPress – Create and Manage Taxonomies, Tags, Categories",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.7.2",
              "lessThan": "3.0.7.2",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-08-02T11:15:09.027",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/164604/WordPress-TaxoPress-3.0.7.1-Cross-Site-Scripting.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/a31321fe-adc6-4480-a220-35aedca52b8b",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "http://packetstormsecurity.com/files/164604/WordPress-TaxoPress-3.0.7.1-Cross-Site-Scripting.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wpscan.com/vulnerability/a31321fe-adc6-4480-a220-35aedca52b8b",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue."
    },
    {
      "lang": "es",
      "value": "El plugin de WordPress TaxoPress - Create and Manage Taxonomies, Tags, Categories antes de la versión 3.0.7.2 no sanea su campo de descripción de la taxonomía, lo que permite a los usuarios con privilegios elevados establecer la carga útil de JavaScript en ellos incluso cuando la capacidad unfiltered_html no está permitida, lo que conduce a un problema de Cross-Site Scripting almacenado autenticado"
    }
  ],
  "lastModified": "2026-06-17T03:40:02.323",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:taxopress:taxopress:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "497C32FE-EE50-435D-A60E-0C7EC9D5B7A9",
              "versionEndExcluding": "3.0.7.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}