CVE-2021-24309: Weekly Schedule < 3.4.3 - Authenticated Stored XSS

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-06-01 · updated 2026-06-17
Weakness: CWE-79

Description

The "Schedule Name" input in the Weekly Schedule WordPress plugin before 3.4.3 general options did not properly sanitize input, allowing a user to inject javascript code using the <script> HTML tags and cause a stored XSS issue

Affected products

Weekly Schedule: before 3.4.3 — fixed in 3.4.3

How to fix

Upgrade to a fixed version: Weekly Schedule 3.4.3. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/ba1d01dc-16e4-464f-94be-ed311ff6ccf9
https://wpscan.com/vulnerability/ba1d01dc-16e4-464f-94be-ed311ff6ccf9

Get alerted when CVE-2021-24309 or the next vulnerability affects your stack