CVEs-PoC/2021/CVE-2021-24309.md

CVE-2021-24309

Description

The "Schedule Name" input in the Weekly Schedule WordPress plugin before 3.4.3 general options did not properly sanitize input, allowing a user to inject javascript code using the <script> HTML tags and cause a stored XSS issue

POC

Reference

• https://wpscan.com/vulnerability/ba1d01dc-16e4-464f-94be-ed311ff6ccf9

Github

• https://github.com/20142995/nuclei-templates