Skip to content
Sign in
Not rated

CVE-2021-24850 The Insert Pages WordPress plugin before 3.7.0 adds a shortcode that prints out other pages' content and custom fields

Description

The Insert Pages WordPress plugin before 3.7.0 adds a shortcode that prints out other pages' content and custom fields. It can be used by users with a role as low as Contributor to perform Cross-Site Scripting attacks by storing the payload/s in another post's custom fields.

Affected products and versions

Product Affected versions Fixed in
Insert Pages 3.7 earliest → < 3.7.0 3.7.0

Other CVEs of Insert Pages

The 3 CVEs of Insert Pages →
CVE-2022-4483 The Insert Pages WordPress plugin before 3.7.5 does not validate and escape some of its shortcode attributes before… 5.4 Medium CVE-2021-24851 The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and… Not rated
Track this CVE