VulnerabilityModified
CVE-2021-24900
The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
MEDIUM 4.8EPSS 0.69%
Does this matter?
Lower severity and a low EPSS score (0.69%). Track it; it rarely justifies an emergency change on its own.
Description
The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- CVSS 3.1
- 4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.69% probability · 51th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- wpmanageninja/ninja tables
- Source
- contact@wpscan.com
References
- https://packetstormsecurity.com/files/164632/Exploit, Third Party Advisory, VDB Entry
- https://wpscan.com/vulnerability/213d7c08-a37c-49d0-a072-24db711da5ecExploit, Third Party Advisory
- https://packetstormsecurity.com/files/164632/Exploit, Third Party Advisory, VDB Entry
- https://wpscan.com/vulnerability/213d7c08-a37c-49d0-a072-24db711da5ecExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.