CVE-2021-24229: patreon patreon wordpress Cross-site Scripting
Vulnerability summary
CVE-2021-24229 is a critical (CVSS 9.6) Cross-site Scripting vulnerability in patreon patreon wordpress. EPSS estimates a 1.76% chance of exploitation in the next 30 days, higher than 77.6% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.7.2.
Timeline
- 12-04-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. This AJAX hook is used to update the pledge level required by Patreon subscribers to access a given attachment. This action is accessible for user accounts with the ‘manage_options’ privilege (i.e.., only administrators). Unfortunately, one of the parameters used in this AJAX endpoint is not sanitized before being printed back to the user, so the risk it represents is the same as the previous XSS vulnerability.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource9.6CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS trend
Probability
1.76%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.76% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (jetpack.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Patreon1 product
- patreon wordpress< 1.7.2
Unknown1 product
- patreon wordpress≥ 1.7.2, < 1.7.2
Wordpress1 product
- patreon-connect< 1.7.2
3 vendors · 3 products
References
3 links- jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/X Refsource MISCExploitThird Party Advisory
- wpscan.com/vulnerability/001755c4-add3-4566-a022-ab1f83546c1fX Refsource CONFIRMThird Party Advisory