CVE-2021-24561

CVE-2021-24561: WP SMS < 5.4.13 - Authenticated Stored Cross-Site Scripting

Vendor Unknown

Product WP SMS

Weakness CWE-79 · XSS

Published August 23, 2021

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" page, leading to an Authenticated Stored Cross-Site Scripting issue

Key dates

02Disclosure timeline

August 23, 2021 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-24561

Related vulnerabilities

04Related CVE

CVE-2026-1438 Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface CVE-2025-7901 yangzongzhuan RuoYi Swagger UI index.html cross site scripting CVE-2022-0648 Team Circle Image Slider With Lightbox < 1.0.16 - Reflected Cross-Site Scripting CVE-2024-8648 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab CVE-2025-5923 Game Review Block <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter