CVE-2021-24617: GamePress <= 1.1.0 - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-10-18 · updated 2026-06-17
Weakness: CWE-79

Description

The GamePress WordPress plugin through 1.1.0 does not escape the op_edit POST parameter before outputting it back in multiple Game Option pages, leading to Reflected Cross-Site Scripting issues

Affected products

GamePress – The Game Database Plugin: through 1.1.0

References

https://wpscan.com/vulnerability/3e262cd7-ca64-4190-8d8c-38b07bbe63e0
https://wpscan.com/vulnerability/3e262cd7-ca64-4190-8d8c-38b07bbe63e0

Get alerted when CVE-2021-24617 or the next vulnerability affects your stack