{"containers":{"cna":{"affected":[{"product":"PlanSo Forms","vendor":"Unknown","versions":[{"lessThanOrEqual":"2.6.3","status":"affected","version":"2.6.3","versionType":"custom"}]}],"credits":[{"lang":"en","value":"Felipe Restrepo Rodriguez"}],"descriptions":[{"lang":"en","value":"The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high privilege users such as admin to set XSS payload in it, even when the unfiltered_html is disallowed, leading to an Authenticated Stored Cross-Site Scripting issue."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Cross-site Scripting (XSS)","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2021-10-18T13:45:43.000Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["x_refsource_MISC"],"url":"https://wpscan.com/vulnerability/88d70e35-4c22-4bc7-b1a5-24068d55257c"}],"source":{"discovery":"EXTERNAL"},"title":"PlanSo Forms <= 2.6.3 - Authenticated Stored Cross-Site Scripting","x_generator":"WPScan CVE Generator","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"contact@wpscan.com","ID":"CVE-2021-24516","STATE":"PUBLIC","TITLE":"PlanSo Forms <= 2.6.3 - Authenticated Stored Cross-Site Scripting"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"PlanSo Forms","version":{"version_data":[{"version_affected":"<=","version_name":"2.6.3","version_value":"2.6.3"}]}}]},"vendor_name":"Unknown"}]}},"credit":[{"lang":"eng","value":"Felipe Restrepo Rodriguez"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high privilege users such as admin to set XSS payload in it, even when the unfiltered_html is disallowed, leading to an Authenticated Stored Cross-Site Scripting issue."}]},"generator":"WPScan CVE Generator","problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79 Cross-site Scripting (XSS)"}]}]},"references":{"reference_data":[{"name":"https://wpscan.com/vulnerability/88d70e35-4c22-4bc7-b1a5-24068d55257c","refsource":"MISC","url":"https://wpscan.com/vulnerability/88d70e35-4c22-4bc7-b1a5-24068d55257c"}]},"source":{"discovery":"EXTERNAL"}}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T19:35:20.061Z"},"title":"CVE Program Container","references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"https://wpscan.com/vulnerability/88d70e35-4c22-4bc7-b1a5-24068d55257c"}]}]},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2021-24516","datePublished":"2021-10-18T13:45:43.000Z","dateReserved":"2021-01-14T00:00:00.000Z","dateUpdated":"2024-08-03T19:35:20.061Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"}