CVE-2021-24277: RSS for Yandex Turbo < 1.30 - Authenticated Stored Cross-Site Scripting (XSS)
Vulnerability summary
CVE-2021-24277 is a medium (CVSS 5.5) Cross-site Scripting vulnerability in flector rss for yandex turbo. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 49% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.30.
Timeline
- 14-05-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The RSS for Yandex Turbo WordPress plugin before 1.30 did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in the page, leading to authenticated stored Cross-Site Scripting issues
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.62%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.62% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Flector1 product
- rss for yandex turbo≥ 1.30, < 1.30
Wordpress1 product
- rss-for-yandex-turbo≤ 1.29 (fixed in 1.30)
Wpuslugi1 product
- rss_for_yandex_turbo< 1.30
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/8ebf56be-46c0-4435-819f-dc30370eafa4X Refsource CONFIRMExploitThird Party Advisory