An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability checks nor sanitization, allowing low privilege users (subscriber+) to call it and set XSS payloads, which will be triggered in all backend pages.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2021-05-05T18:39:42

Updated: 2024-08-03T19:21:18.708Z

Reserved: 2021-01-14T00:00:00

Link: CVE-2021-24243

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-05-06T13:15:11.463

Modified: 2024-11-21T05:52:40.407

Link: CVE-2021-24243

cve-icon Redhat

No data.