Unrated severityNVD Advisory· Published May 24, 2021· Updated Aug 3, 2024
Target First Plugin 2.0 - Unauthenticated Stored XSS via Licence Key
CVE-2021-24305
Description
The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the 'weeWzKey' parameter that will be save as the 'weeID option and is not sanitized.
Affected products
1- Range: 2.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- wpscan.com/vulnerability/4d55d1f5-a7b8-4029-942d-7a13e2498f64mitrex_refsource_CONFIRM
- www.targetfirst.commitrex_refsource_MISC
News mentions
0No linked articles in our index yet.