Which products and versions are affected by CVE-2021-24275?

Affected: Popup (Supsystic); Popup by Supsystic (wordpress-plugin) versions >= 1.10.5. The full list is in the CVE brief.

Is CVE-2021-24275 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2021-24275 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2021-24275?

Public exploit code is available.

Is there a fix for CVE-2021-24275?

Fixed versions are available, including Popup by Supsystic 1.10.5, Popup 1.10.5.

How urgently should CVE-2021-24275 be patched?

Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

Request A Demo

Vulnerability Intelligence

CVE-2021-24275

MediumPublic exploit

Popup by Supsystic <= 1.10.4 - Reflected Cross-Site Scripting

Published May 6, 2021 · Updated Aug 3, 2024 · Also known as 0c1ebc88-0987-46d6-9e80-6f3aa50d10af

Key Facts

Routine patching

CVE-2021-24275 is a medium-severity vulnerability (CVSS 6.1 v3.1) affecting Popup (Supsystic), Popup by Supsystic (wordpress-plugin).
It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
EPSS estimates a 18% probability of exploitation in the next 30 days.
Fixed versions are available, including Popup by Supsystic 1.10.5, Popup 1.10.5.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

CVSS v3.1

6.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS (30-day exploit likelihood)

18%

Higher than 97.1% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2021-24275 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue

Affected Products

3 affected entries in total

Product	Affected versions	Fixed in
PopupSupsystic	See advisory	1.10.5
Popup by Supsysticwordpress-plugin	>= 1.10.5	1.10.5

Patched Releases

Popup by Supsystic

1.10.5

Popup

1.10.5

Timeline

Publicly disclosed
May 6, 2021
Last updated
Aug 3, 2024

Weakness Type

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References

11 more references in the full CVE brief

FAQ

Common Questions.

The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
Affected: Popup (Supsystic); Popup by Supsystic (wordpress-plugin) versions >= 1.10.5. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Popup by Supsystic 1.10.5, Popup 1.10.5.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

Is CVE-2021-24275 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.