CVE-2021-24428

RSS for Yandex Turbo <= 1.30 - Authenticated Stored XSS

4.8 Medium

The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its settings before saving and outputing them in the admin dashboard, leading to an Authenticated Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.55%Down 0.1 points since Aug 3, 2021

What each source reports

NVD Score used 4.8

Record: CVE-2021-24428
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

RSS for Yandex Turbo <= 1.30 - Authenticated Stored XSS

Record: CVE-2021-24428
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2021-11340 No score

Record: EUVD-2021-11340
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jfq9-cmj2-f55w No score

The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its...

Record: GHSA-jfq9-cmj2-f55w
Weakness: CWE-79
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-24428 is a medium vulnerability (CVSS 4.8) in Unknown Rss For Yandex Turbo, published August 2, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. No source names a fixed version.