CVE-2021-24304: Newsmag < 5.0 - Unauthenticated Reflected Cross-site Scripting (XSS)

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-09 · updated 2026-06-17
Weakness: CWE-79

Description

The Newsmag WordPress theme before 5.0 does not sanitise the td_block_id parameter in its td_ajax_block AJAX action, leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability.

Affected products

tagDiv Newsmag: before 5.0 — fixed in 5.0

How to fix

Upgrade to a fixed version: tagDiv Newsmag 5.0. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/bb71f2f9-76bd-43f4-a8c9-35771dd28dff
https://wpscan.com/vulnerability/bb71f2f9-76bd-43f4-a8c9-35771dd28dff

Get alerted when CVE-2021-24304 or the next vulnerability affects your stack