Medium severity6.1NVD Advisory· Published Jul 12, 2021· Updated Jun 17, 2026

CVE-2021-24409

Description

The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Plugin Planet/Prismatic
cpe:2.3:a:plugin-planet:prismatic:*:*:*:*:*:wordpress:*:*
Range: <2.8
WordPress/Prismaticllm-fuzzy
Range: <2.8
Package: https://wordpress.org/plugins/prismatic
Jeff Starr/Prismaticv5
Range: 2.8

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/ae3cd3ed-aecd-4d8c-8a2b-2936aaaef0cfnvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000