Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2021-24366

Admin Columns Free < 4.3 & Pro < 5.5.1 - Admin+ Stored XSS in Label

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Admin Columns WordPress plugin before 4.3 and Admin Columns Pro WordPress plugin before 5.5.1 do not sanitise and escape its Label settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Admin Columns

Default version status: unaffected

  • 3.0 to < 4.3affected

Unknown Admin Columns Pro

Default version status: unaffected

  • 0 to < 5.5.1affected

References