CVE-2021-24342: JNews < 8.0.6 - Reflected Cross-Site Scripting (XSS)

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-06-07 · updated 2026-06-17
Weakness: CWE-79

Description

The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue.

Affected products

JNews: before 8.0.6 — fixed in 8.0.6

How to fix

Upgrade to a fixed version: JNews 8.0.6. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/415ca763-fe65-48cb-acd3-b375a400217e
https://wpscan.com/vulnerability/415ca763-fe65-48cb-acd3-b375a400217e

Get alerted when CVE-2021-24342 or the next vulnerability affects your stack