What’s Vulnerable › Vulnerabilities

CVE-2021-24432: Advanced AJAX Product Filters < 1.5.4.7 - Unauthenticated Reflected Cross-Site Scripting (XSS)

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-01-16 · updated 2026-06-17
• Weakness: CWE-79

Description

The Advanced AJAX Product Filters WordPress plugin does not sanitise the 'term_id' POST parameter before outputting it in the page, leading to reflected Cross-Site Scripting issue.

Affected products

• BeRocket Advanced AJAX Product Filters: before 1.5.4.7 — fixed in 1.5.4.7

How to fix

Upgrade to a fixed version: BeRocket Advanced AJAX Product Filters 1.5.4.7. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/b92ec5f7-d6a8-476f-a01e-21001a558914/
• https://wpscan.com/vulnerability/b92ec5f7-d6a8-476f-a01e-21001a558914/

Get alerted when CVE-2021-24432 or the next vulnerability affects your stack