VDB
CVE-2021-24438
CVE-2021-24438
PUBLISHED
CVSS 6.099999904632568 MEDIUM
The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
EPSS 0.83% · 55.9th percentile
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score
0.83%
55.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Unknown | ShareThis Dashboard for Google Analytics | 2.5.2 |
| sharethis | dashboard_for_google_analytics | 0 |
Timeline
- Aug 30, 2021 CVE Published
- Aug 31, 2021 EPSS Score
- Oct 28, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 22, 2022 EPSS Score
- Apr 22, 2022 EPSS Score
- Jun 19, 2022 EPSS Score
- Aug 18, 2022 EPSS Score
- Oct 15, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Mar 7, 2023 EPSS Score