.. / CVE-2021-24298

• XSS
• Nuclei
• Web

Exploit for WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting (CVE-2021-24298)

Description:

WordPress Simple Giveaways plugin before 2.36.2 contains a cross-site scripting vulnerability via the method and share GET parameters of the Giveaway pages, which are not sanitized, validated, or escaped before being output back in the pages.

Nuclei Template

View the template here CVE-2021-24298.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-24298.yaml

References: