CVE-2021-24587

The Splash Header WordPress plugin before 1.20.8 doesn't sanitise and escape some of its settings while outputting them in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue.

Score

CVSS 3.1 5.4 Medium

Status

Modified - contact@wpscan.com

Published

2021-09-20

Last modified

2024-08-03

Weaknesses

CWE-79

Affected products

• Splash Header (Unknown)
• Splash Header (Zeesweb)

References

• https://wpscan.com/vulnerability/bb5d94ad-e1ce-44e2-8403-d73fe75a146a