CVE-2021-24419

Katalog CVE

CVSS 4.8 · Medium EPSS 0,63%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada wp youtube lyte project wp youtube lyte. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

The WP YouTube Lyte WordPress plugin before 1.7.16 did not sanitise or escape its lyte_yt_api_key and lyte_notification settings before outputting them back in the page, allowing high privilege users to set XSS payload on them and leading to stored Cross-Site Scripting issues.

Rincian

Terbit di NVD

12 Juli 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wpscan.com/vulnerability/0eeff1ee-d11e-4d52-a032-5f5bd8a6a2d7 exploit · advisory pihak ketiga
• https://m0ze.ru/vulnerability/%5B2021-05-03%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-YouTube-Lyte-WordPress-Plugin-v...