« Volver al listado

CVE-2021-24516

Estado: ModificadaMedia (4.8)—

El plugin PlanSo Forms de WordPress versiones hasta 2.6.3 no escapa el título de su Formulario antes de mostrarlo en los atributos, permitiendo a usuarios con privilegios elevados, como los administradores, establecer cargas útiles de tipo XSS en él, incluso cuando no es permitido el uso de unfiltered_html, conllevando a un problema de tipo Cross-Site Scripting issue Almacenado y Autenticado

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Planso — Planso Forms

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-24516",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "PlanSo Forms",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.3",
              "versionType": "custom",
              "lessThanOrEqual": "2.6.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-10-18T14:15:09.080",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/88d70e35-4c22-4bc7-b1a5-24068d55257c",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/88d70e35-4c22-4bc7-b1a5-24068d55257c",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high privilege users such as admin to set XSS payload in it, even when the unfiltered_html is disallowed, leading to an Authenticated Stored Cross-Site Scripting issue."
    },
    {
      "lang": "es",
      "value": "El plugin PlanSo Forms de WordPress versiones hasta 2.6.3 no escapa el título de su Formulario antes de mostrarlo en los atributos, permitiendo a usuarios con privilegios elevados, como los administradores, establecer cargas útiles de tipo XSS en él, incluso cuando no es permitido el uso de unfiltered_html, conllevando a un problema de tipo Cross-Site Scripting issue Almacenado y Autenticado"
    }
  ],
  "lastModified": "2026-06-17T03:40:10.040",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:planso:planso_forms:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BCCDC7A-CA17-401E-8050-6E50973A97C8",
              "versionEndIncluding": "2.6.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}