CVE-2021-24904
MediumPublished
Mortgage Calculators WP < 1.56 - Admin+ Stored Cross-Site Scripting
- Published
- Feb 14, 2022
- Updated
- Aug 3, 2024
- Assigning CNA
- WPScan
- Evidence observed
- Jan 27, 2022
Primary CVSS
4.8/ 10Medium
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N5.1%
Low · next 30 days
- Percentile
- 92.0%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Sources
1- WordPress Plugin Mortgage Calculators WP 1.52 - Stored Cross-Site Scripting (XSS) (Authenticated)Exploit
Ceylan BOZOĞULLARINDAN · php · Jan 27, 2022
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.