6.1

CVE-2021-24488: Post Grid < 2.1.8 - Reflected Cross-Site Scripting (XSS)

Modified
Published 02-08-2021Last modified 03-08-2024

Vulnerability summary

CVE-2021-24488 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in pickplugins post_grid. EPSS estimates a 11.24% chance of exploitation in the next 30 days, higher than 95.9% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
37/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.1 (NVD)
EPSS score
11.24%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits2reference, exploit-database

Timeline

  1. 02-08-2021
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

11.24%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 11.24% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (wpscan.com)

    Maturity: unknown

  • exploit-databasephpUnverified

    WordPress Plugin Post Grid 2.1.1 - Cross Site Scripting (XSS)

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Pickplugins1 product
Unknown1 product
Wordpress1 product
  • post-grid≤ 2.1.7 (fixed in 2.1.8)

3 vendors · 3 products

References

2 links