What’s Vulnerable › Vulnerabilities

CVE-2021-24479: DrawBlog <= 0.90 - Authenticated Stored Cross-Site Scripting (XSS)

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-08-02 · updated 2026-06-17
• Weakness: CWE-79

Description

The DrawBlog WordPress plugin through 0.90 does not sanitise or validate some of its settings before outputting them back in the page, leading to an authenticated stored Cross-Site Scripting issue

Affected products

• DrawBlog: through 0.90

References

• https://wpscan.com/vulnerability/5fd2246a-fbd9-4f2a-8b0b-a64c3f91157c
• https://wpscan.com/vulnerability/5fd2246a-fbd9-4f2a-8b0b-a64c3f91157c

Get alerted when CVE-2021-24479 or the next vulnerability affects your stack