CVE-2021-24274 PoC — Ultimate Maps by Supsystic < 1.2.5 - Reflected Cross-Site scripting (XSS)

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24274.yaml

Associated Vulnerability

Title: Ultimate Maps by Supsystic < 1.2.5 - Reflected Cross-Site scripting (XSS) (CVE-2021-24274)
Description:The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue

Description

WordPress Supsystic Ultimate Maps plugin before 1.2.5 contains an unauthenticated reflected cross-site scripting vulnerability due to improper sanitization of the tab parameter on the options page before outputting it in an attribute.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →