6.1

CVE-2021-24300: PickPlugins Product Slider for WooCommerce < 1.13.22 - Reflected Cross-Site Scripting (XSS)

Modified
Published 24-05-2021Last modified 03-08-2024

Vulnerability summary

CVE-2021-24300 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in pickplugins pickplugins product slider for woocommerce. EPSS estimates a 10.59% chance of exploitation in the next 30 days, higher than 95.7% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
37/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.1 (NVD)
EPSS score
10.59%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits2reference, exploit-database

Timeline

  1. 24-05-2021
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

10.59%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 10.59% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (wpscan.com)

    Maturity: unknown

  • exploit-databasephpUnverified

    WordPress Plugin Product Slider for WooCommerce 1.13.21 - Cross Site Scripting (XSS)

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Pickplugins2 products
Wordpress1 product
  • woocommerce-products-slider≤ 1.13.21 (fixed in 1.13.22)

2 vendors · 3 products

References

2 links