CVE-2021-24246 | BDVDB-2026-153121 Detail

PureThemesWorkscout Core

Description#

The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX action, leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues

Impact#

No impact statement in the source data.

Weaknesses#

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

https://wpscan.com/vulnerability/2365a9d0-f6f4-4602-9804-5af23d0cb11d
https://m0ze.ru/vulnerability/%5B2021-02-10%5D-%5BWordPress%5D-%5BCWE-79%5D-WorkScout-WordPress-Theme-v2.0.33.txt

Exploit#

No public exploit known

History#

Version 12021-05-05Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.