{"id":"CVE-2021-24622","aliases":["EUVD-2021-11534","GHSA-r978-rv42-vg57"],"status":"published","title":"WP Ticket \u003c 5.10.4 - Admin+ Stored Cross-Site Scripting","description":"The Customer Service Software \u0026 Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00643,"percentile":0.5115,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2021-10-18T13:45:50Z","modified":"2026-06-17T03:40:20Z","products":[{"vendor":"emarketdesign","product":"customer_service_software_\\\u0026_support_ticket_system"},{"vendor":"unknown","product":"customer service software \u0026 support ticket system"}],"references":[{"url":"https://wpscan.com/vulnerability/41a2c72c-7db1-473a-8844-47f6ae9d0594","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-24622"},{"url":"https://github.com/advisories/GHSA-r978-rv42-vg57"}],"sources":{"cve":[{"id":"CVE-2021-24622","title":"WP Ticket \u003c 5.10.4 - Admin+ Stored Cross-Site Scripting","description":"The Customer Service Software \u0026 Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.","status":"published","published":"2021-10-18T13:45:50Z","modified":"2024-08-03T19:35:20.252Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:05.000797Z"}],"euvd":[{"id":"EUVD-2021-11534","description":"The Customer Service Software \u0026 Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.","status":"published","published":"2021-10-18T13:45:50Z","modified":"2024-08-03T19:35:20Z","updated_at":"2026-11-03T03:24:56.857735Z"}],"ghsa":[{"id":"GHSA-r978-rv42-vg57","title":"The Customer Service Software \u0026 Support Ticket System WordPress plugin before 5.10.4 does not...","description":"The Customer Service Software \u0026 Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.","status":"published","published":"2022-05-24T19:17:48Z","modified":"2023-01-30T05:02:52Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:46:44.129156Z"}],"nvd":[{"id":"CVE-2021-24622","description":"The Customer Service Software \u0026 Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.","status":"published","published":"2021-10-18T14:15:09.387Z","modified":"2026-06-17T03:40:20.663Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:59.689345Z"}]}}