{"id":"CVE-2021-24287","url":"https://www.cyber-defence.io/tools/cve/CVE-2021-24287","generatedAt":"2026-10-27T22:27:53.834Z","title":"The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue","description":"The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue","published":"2021-05-14T12:15:08.000Z","lastModified":"2026-06-17T03:39:46.000Z","status":"Modified","sourceIdentifier":"contact@wpscan.com","cvss":{"version":"3.1","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["mooveagency/select all categories and taxonomies\\, change checkbox to radio buttons"],"epss":{"score":0.10358,"percentile":0.95686,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2021-09-29","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":50349,"kind":"exploit","title":"WordPress Plugin Select All Categories and Taxonomies 1.3.1 - Reflected Cross-Site Scripting (XSS)","url":"https://www.exploit-db.com/exploits/50349","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/50349.txt","file":"exploits/php/webapps/50349.txt","published":"2021-09-29","added":"2021-09-29","updated":"2021-10-28","author":"0xB9","type":"webapps","platform":"php","port":null,"verified":false,"codes":["CVE-2021-24287"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comselect-all-categories-and-taxonomies-change-checkbox-to-radio-buttons.1.3.1.zip","screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 10.4%, higher than 96% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://packetstormsecurity.com/files/164327/WordPress-Select-All-Categories-And-Taxonomies-1.3.1-Cross-Site-Scripting.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"contact@wpscan.com"},{"url":"https://wpscan.com/vulnerability/56e1bb56-bfc5-40dd-b2d0-edef43d89bdf","tags":["Exploit","Third Party Advisory"],"source":"contact@wpscan.com"},{"url":"http://packetstormsecurity.com/files/164327/WordPress-Select-All-Categories-And-Taxonomies-1.3.1-Cross-Site-Scripting.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://wpscan.com/vulnerability/56e1bb56-bfc5-40dd-b2d0-edef43d89bdf","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-24287","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}