CVE-2021-24558 json
Project Status <= 1.6 - Reflected Cross-Site Scripting (XSS)
published 2021-08-23 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-11470
- cvss
- 5.4
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parameter passed to it before outputting it in an error message when the related post does not exist, leading to a reflected XSS issue
Exploit prediction
0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- wpscan.com https://wpscan.com/vulnerability/ca5f2152-fcfd-492d-a552-f9604011beff referenced PoC, tagged "exploit" by a source, unverified
- codevigilant.com https://codevigilant.com/disclosure/2021/wp-plugin-project-status/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
Affected products
- Unknown Project Status
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
- Technology feeds
References
-
wpscan.com
/vulnerability/ca5f2152-fcfd-492d-a552-f9604011beff
exploit, third-party-advisory
-
codevigilant.com
/disclosure/2021/wp-plugin-project-status/
exploit, third-party-advisory
Sources
- CVE List CVE-2021-24558
- NVD CVE-2021-24558
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.