{"id":"CVE-2021-24504","state":"PUBLISHED","title":"WP LMS <= 1.1.2 - Stored Cross-Site Scripting (XSS)","description":"The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated)","publishedAt":"2021-08-02T10:32:30.000Z","updatedAt":"2024-08-03T19:35:20.022Z","severity":null,"assigner":"WPScan","products":["Unknown WP LMS – Best WordPress LMS Plugin"],"affected":[{"vendor":"Unknown","product":"WP LMS – Best WordPress LMS Plugin","versions":[{"version":"1.1.2","status":"affected","lessThanOrEqual":"1.1.2","versionType":"custom"}]}],"references":["https://wpscan.com/vulnerability/e0182508-23f4-4bdb-a1ef-1d1be38f3ad1"],"weaknesses":["CWE-79","CWE-352"],"ingestedAt":"2026-10-29T19:48:07.505Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/24xxx/CVE-2021-24504.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-24504","state":"PUBLISHED","datePublished":"2021-08-02T10:32:30.000Z","dateUpdated":"2024-08-03T19:35:20.022Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2021-01-14T00:00:00.000Z"},"containers":{"cna":{"title":"WP LMS <= 1.1.2 - Stored Cross-Site Scripting (XSS)","descriptions":[{"lang":"en","value":"The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated)"}],"affected":[{"vendor":"Unknown","product":"WP LMS – Best WordPress LMS Plugin","versions":[{"version":"1.1.2","status":"affected","lessThanOrEqual":"1.1.2","versionType":"custom"}]}],"references":[{"url":"https://wpscan.com/vulnerability/e0182508-23f4-4bdb-a1ef-1d1be38f3ad1","tags":["x_refsource_MISC"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Cross-site Scripting (XSS)","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-352","description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","dateUpdated":"2021-08-02T10:32:30.000Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81"},"credits":[{"lang":"en","value":"Mohammed Adam"}],"source":{"discovery":"UNKNOWN"},"x_generator":"WPScan CVE Generator","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"contact@wpscan.com","ID":"CVE-2021-24504","STATE":"PUBLIC","TITLE":"WP LMS <= 1.1.2 - Stored Cross-Site Scripting (XSS)"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"WP LMS – Best WordPress LMS Plugin","version":{"version_data":[{"version_affected":"<=","version_name":"1.1.2","version_value":"1.1.2"}]}}]},"vendor_name":"Unknown"}]}},"credit":[{"lang":"eng","value":"Mohammed Adam"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated)"}]},"generator":"WPScan CVE Generator","problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79 Cross-site Scripting (XSS)"}]},{"description":[{"lang":"eng","value":"CWE-352 Cross-Site Request Forgery (CSRF)"}]}]},"references":{"reference_data":[{"name":"https://wpscan.com/vulnerability/e0182508-23f4-4bdb-a1ef-1d1be38f3ad1","refsource":"MISC","url":"https://wpscan.com/vulnerability/e0182508-23f4-4bdb-a1ef-1d1be38f3ad1"}]},"source":{"discovery":"UNKNOWN"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/e0182508-23f4-4bdb-a1ef-1d1be38f3ad1","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T19:35:20.022Z"}}]}}}