Description
The Duplicate Page WordPress plugin through 4.4.2 does not sanitise or escape the Duplicate Post Suffix settings before outputting it, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Duplicate Page | 4.4.2 – ≤ 4.4.2 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Duplicate Page WordPress - Stored Cross-Site Scripting http/cves/2021/CVE-2021-24681.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.