Medium severity4.8NVD Advisory· Published Nov 17, 2021· Updated Jun 17, 2026

CVE-2021-24856

Description

The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Shared Files plugindescription
WordPress/Shared Filesllm-fuzzy
Range: <1.6.61
Package: https://wordpress.org/plugins/shared-files

Patches

Vulnerability mechanics

References

mikadmin.fr/tech/XSS-Stored-Shared-Files-a837703ad010d111be11ffdf478aa6114F0lK656bV.pdfnvdExploitThird Party Advisory
wpscan.com/vulnerability/8fd483fb-d399-4b4f-b4ef-bbfad1b5cf1bnvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000