CVE-2021-24476: Steam Group Viewer <= 2.1 - Authenticated Stored Cross-Site Scripting (XSS)

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-02 · updated 2026-06-17
Weakness: CWE-79

Description

The Steam Group Viewer WordPress plugin through 2.1 does not sanitise or escape its "Steam Group Address" settings before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue

Affected products

Steam Group Viewer: through 2.1

References

https://wpscan.com/vulnerability/d1885641-9547-4dd5-84be-ba4a160ee1f5
https://wpscan.com/vulnerability/d1885641-9547-4dd5-84be-ba4a160ee1f5

Get alerted when CVE-2021-24476 or the next vulnerability affects your stack