CVEs-PoC/2021/CVE-2021-24708.md

CVE-2021-24708

Description

The Export any WordPress data to XML/CSV WordPress plugin before 1.3.1 does not escape its Export's Name before outputting it in Manage Exports settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

POC

Reference

• https://wpscan.com/vulnerability/4560eef4-253b-49a4-8e20-9520c45c6f7f
• https://wpscan.com/vulnerability/4560eef4-253b-49a4-8e20-9520c45c6f7f

Github

No PoCs found on GitHub currently.