{"id":"CVE-2021-24489","aliases":["CLSA-2021-1635459202","EUVD-2021-11401","GHSA-gqjm-7fj6-9xvx"],"status":"published","title":"Request a Quote \u003c 2.3.9 - Admin+ Stored Cross-Site Scripting","description":"The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00643,"percentile":0.51162,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2021-10-25T13:20:38Z","modified":"2026-06-17T03:40:07Z","affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"intel-microcode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20210608.0ubuntu0.16.04.1+cloudlinux.els1"}]}],"bundled":4}],"products":[{"vendor":"emarket-design","product":"request a quote"},{"vendor":"emarketdesign","product":"request_a_quote"},{"vendor":"unknown","product":"request a quote"}],"references":[{"url":"https://wpscan.com/vulnerability/36e8efe8-b29f-4c9e-9dd5-3e317aa43e0c","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-24489"},{"url":"https://github.com/advisories/GHSA-gqjm-7fj6-9xvx"},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2021-1635459202","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-24489","title":"Request a Quote \u003c 2.3.9 - Admin+ Stored Cross-Site Scripting","description":"The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.","status":"published","published":"2021-10-25T13:20:38Z","modified":"2024-08-03T19:35:20.198Z","updated_at":"2026-11-02T14:33:04.679189Z"}],"euvd":[{"id":"EUVD-2021-11401","description":"The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.","status":"published","published":"2021-10-25T13:20:38Z","modified":"2024-08-03T19:35:20Z","updated_at":"2026-11-03T03:24:57.403647Z"}],"ghsa":[{"id":"GHSA-gqjm-7fj6-9xvx","title":"The Request a Quote WordPress plugin before 2.3.5 does not sanitise, validate or escape some of...","description":"The Request a Quote WordPress plugin before 2.3.5 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.","status":"published","published":"2022-05-24T19:18:44Z","modified":"2023-04-13T05:00:51Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:54:29.326702Z"}],"nvd":[{"id":"CVE-2021-24489","description":"The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.","status":"published","published":"2021-10-25T14:15:10.143Z","modified":"2026-06-17T03:40:07.293Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:00.137719Z"}],"osv":[{"id":"CLSA-2021-1635459202","title":"Fix CVE(s): CVE-2020-24512, CVE-2020-24511, CVE-2021-24489, CVE-2020-24513","description":"\n   * SECURITY UPDATE: New microcode data file 2021-06-08\n     + New Microcodes:\n       sig 0x00050655, pf_mask 0xb7, 2018-11-16, rev 0x3000010, size 47104\n       sig 0x000606a5, pf_mask 0x87, 2021-03-08, rev 0xc0002f0, size 283648\n       sig 0x000606a6, pf_mask 0x87, 2021-04-25, rev 0xd0002a0, size 283648\n       sig 0x00080664, pf_mask 0x01, 2021-02-17, rev 0xb00000f, size 130048\n       sig 0x00080665, pf_mask 0x01, 2021-02-17, rev 0xb00000f, size 130048\n       sig 0x000806c1, pf_mask 0x80, 2021-03-31, rev 0x0088, size 109568\n       sig 0x000806c2, pf_mask 0xc2, 2021-04-07, rev 0x0016, size 94208\n       sig 0x000806d1, pf_mask 0xc2, 2021-04-23, rev 0x002c, size 99328\n       sig 0x00090661, pf_mask 0x01, 2021-02-04, rev 0x0011, size 19456\n       sig 0x000906c0, pf_mask 0x01, 2021-03-23, rev 0x001d, size 19456\n       sig 0x000a0671, pf_mask 0x02, 2021-04-11, rev 0x0040, size 100352\n     + Updated Microcodes:\n       sig 0x000306f2, pf_mask 0x6f, 2021-01-27, rev 0x0046, size 34816\n       sig 0x000306f4, pf_mask 0x80, 2021-02-05, rev 0x0019, size 19456\n       sig 0x000406e3, pf_mask 0xc0, 2021-01-25, rev 0x00ea, size 105472\n       sig 0x000406f1, pf_mask 0xef, 2021-02-06, rev 0xb00003e, size 31744\n       sig 0x00050653, pf_mask 0x97, 2021-03-08, rev 0x100015b, size 34816\n       sig 0x00050654, pf_mask 0xb7, 2021-03-08, rev 0x2006b06, size 36864\n       sig 0x00050656, pf_mask 0xbf, 2021-03-08, rev 0x4003102, size 30720\n       sig 0x00050657, pf_mask 0xbf, 2021-03-08, rev 0x5003102, size 30720\n       sig 0x0005065b, pf_mask 0xbf, 2021-04-23, rev 0x7002302, size 27648\n       sig 0x00050663, pf_mask 0x10, 2021-02-04, rev 0x700001b, size 24576\n       sig 0x00050664, pf_mask 0x10, 2021-02-04, rev 0xf000019, size 24576\n       sig 0x00050665, pf_mask 0x10, 2021-02-04, rev 0xe000012, size 19456\n       sig 0x000506c9, pf_mask 0x03, 2020-10-23, rev 0x0044, size 17408\n       sig 0x000506ca, pf_mask 0x03, 2020-10-23, rev 0x0020, size 15360\n       sig 0x000506e3, pf_mask 0x36, 2021-01-25, rev 0x00ea, size 105472\n       sig 0x000506f1, pf_mask 0x01, 2020-10-23, rev 0x0034, size 11264\n       sig 0x000706a1, pf_mask 0x01, 2020-10-23, rev 0x0036, size 74752\n       sig 0x000706a8, pf_mask 0x01, 2020-10-23, rev 0x001a, size 75776\n       sig 0x000706e5, pf_mask 0x80, 2020-11-01, rev 0x00a6, size 110592\n       sig 0x000806a1, pf_mask 0x10, 2020-11-06, rev 0x002a, size 32768\n       sig 0x000806e9, pf_mask 0xc0, 2021-01-05, rev 0x00ea, size 104448\n       sig 0x000806e9, pf_mask 0x10, 2021-01-05, rev 0x00ea, size 104448\n       sig 0x000806ea, pf_mask 0xc0, 2021-01-06, rev 0x00ea, size 103424\n       sig 0x000806eb, pf_mask 0xd0, 2021-01-05, rev 0x00ea, size 104448\n       sig 0x000806ec, pf_mask 0x94, 2021-01-05, rev 0x00ea, size 104448\n       sig 0x000906e9, pf_mask 0x2a, 2021-01-05, rev 0x00ea, size 104448\n       sig 0x000906ea, pf_mask 0x22, 2021-01-05, rev 0x00ea, size 102400\n       sig 0x000906eb, pf_mask 0x02, 2021-01-05, rev 0x00ea, size 104448\n       sig 0x000906ec, pf_mask 0x22, 2021-01-05, rev 0x00ea, size 103424\n       sig 0x000906ed, pf_mask 0x22, 2021-01-05, rev 0x00ea, size 103424\n       sig 0x000a0652, pf_mask 0x20, 2021-02-07, rev 0x00ea, size 93184\n       sig 0x000a0653, pf_mask 0x22, 2021-03-08, rev 0x00ea, size 94208\n       sig 0x000a0655, pf_mask 0x22, 2021-03-08, rev 0x00ec, size 94208\n       sig 0x000a0660, pf_mask 0x80, 2020-12-08, rev 0x00e8, size 94208\n       sig 0x000a0661, pf_mask 0x80, 2021-02-07, rev 0x00ea, size 93184\n     - CVE-2021-24489, INTEL-TA-00442\n     - CVE-2020-24511, INTEL-TA-00464\n     - CVE-2020-24512, INTEL-TA-00464\n     - CVE-2020-24513, INTEL-TA-00465","status":"published","published":"2021-10-28T22:13:22Z","modified":"2026-06-04T10:04:25.117048873Z","updated_at":"2026-11-02T15:43:39.801198Z"}]}}