CVE-2021-24924

CVE-2021-24924: Email Log < 2.4.8 - Reflected Cross-Site Scripting

Vendor Unknown

Product Email Log

Weakness CWE-79 · XSS

Published December 6, 2021

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Email Log WordPress plugin before 2.4.8 does not escape the d parameter before outputting it back in an attribute in the Log page, leading to a Reflected Cross-Site Scripting issue

Key dates

02Disclosure timeline

December 6, 2021 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-24924 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2023-4520 FV Flowplayer Video Player <= 7.5.37.7212 - Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update CVE-2024-40875 Cross-site scripting vulnerability in the Secure Access administrative console prior to 13.52 CVE-2023-0746 XSS Vulnerability in GigaVue-FM CVE-2025-5770 Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products CVE-2023-2021 Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass