CVE-2021-24564

CVE-2021-24564: WPFront Scroll Top < 2.0.6.07225 - Authenticated Stored XSS

Vendor Unknown

Product WPFront Scroll Top

Weakness CWE-79 · XSS

Published August 23, 2021

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The WPFront Scroll Top WordPress plugin before 2.0.6.07225 does not sanitise or escape its Image ALT setting before outputting it attributes, leading to an Authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.

Key dates

02Disclosure timeline

August 23, 2021 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-24564 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2024-35706 WordPress Heateor Social Login WordPress plugin <= 1.1.32 - Cross Site Scripting (XSS) vulnerability CVE-2025-8349 Cross-Site Scripting (XSS) stored in Tawk Live Chat CVE-2024-35153 IBM WebSphere Application Server cross-site scripting CVE-2026-42663 WordPress Simple Membership plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerability CVE-2018-25097 Acumos Design Studio cross site scripting