{"id":"CVE-2021-24976","state":"PUBLISHED","title":"Smart SEO Tool < 3.0.6 - Reflected Cross-Site Scripting","description":"The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled, leading to a Reflected Cross-Site Scripting","publishedAt":"2022-01-24T08:01:02.000Z","updatedAt":"2024-08-03T19:49:14.366Z","severity":null,"assigner":"WPScan","products":["Unknown Smart SEO Tool – SEO优化插件"],"affected":[{"vendor":"Unknown","product":"Smart SEO Tool – SEO优化插件","versions":[{"version":"3.0.6","status":"affected","lessThan":"3.0.6","versionType":"custom"}]}],"references":["https://wpscan.com/vulnerability/7d5f58a8-bee4-46be-9c08-d272678338f0","https://plugins.trac.wordpress.org/changeset/2637305"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:48:07.505Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/24xxx/CVE-2021-24976.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-24976","state":"PUBLISHED","datePublished":"2022-01-24T08:01:02.000Z","dateUpdated":"2024-08-03T19:49:14.366Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2021-01-14T00:00:00.000Z"},"containers":{"cna":{"title":"Smart SEO Tool < 3.0.6 - Reflected Cross-Site Scripting","descriptions":[{"lang":"en","value":"The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled, leading to a Reflected Cross-Site Scripting"}],"affected":[{"vendor":"Unknown","product":"Smart SEO Tool – SEO优化插件","versions":[{"version":"3.0.6","status":"affected","lessThan":"3.0.6","versionType":"custom"}]}],"references":[{"url":"https://wpscan.com/vulnerability/7d5f58a8-bee4-46be-9c08-d272678338f0","tags":["x_refsource_MISC"]},{"url":"https://plugins.trac.wordpress.org/changeset/2637305","tags":["x_refsource_CONFIRM"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Cross-site Scripting (XSS)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","dateUpdated":"2022-01-24T08:01:02.000Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81"},"credits":[{"lang":"en","value":"lnsmile"}],"source":{"discovery":"EXTERNAL"},"x_generator":"WPScan CVE Generator","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"contact@wpscan.com","ID":"CVE-2021-24976","STATE":"PUBLIC","TITLE":"Smart SEO Tool < 3.0.6 - Reflected Cross-Site Scripting"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Smart SEO Tool – SEO优化插件","version":{"version_data":[{"version_affected":"<","version_name":"3.0.6","version_value":"3.0.6"}]}}]},"vendor_name":"Unknown"}]}},"credit":[{"lang":"eng","value":"lnsmile"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled, leading to a Reflected Cross-Site Scripting"}]},"generator":"WPScan CVE Generator","problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79 Cross-site Scripting (XSS)"}]}]},"references":{"reference_data":[{"name":"https://wpscan.com/vulnerability/7d5f58a8-bee4-46be-9c08-d272678338f0","refsource":"MISC","url":"https://wpscan.com/vulnerability/7d5f58a8-bee4-46be-9c08-d272678338f0"},{"name":"https://plugins.trac.wordpress.org/changeset/2637305","refsource":"CONFIRM","url":"https://plugins.trac.wordpress.org/changeset/2637305"}]},"source":{"discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/7d5f58a8-bee4-46be-9c08-d272678338f0","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://plugins.trac.wordpress.org/changeset/2637305","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T19:49:14.366Z"}}]}}}