Gianism < 5.2.1 – Admin+ Stored XSS | CVE 2024-3921 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

1. Go to https://example.com/wp-admin/options-general.php?page=gianism&view=setting
2. In the "URL Prefix" field, enter the payload `<img src=xss onerror=alert(1)>`
3. Save and see the XSS

Affects Plugins

Fixed in 5.2.1

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Felipe Restrepo Rodriguez, Mateo Gutierrez Gomez

Submitter

Felipe Restrepo Rodriguez, Mateo Gutierrez Gomez

Submitter website

https://pfelilpe.com

Submitter twitter

Verified

Yes

WPVDB ID

3c114e14-9113-411d-91f3-2e2daeb40739

Timeline

Publicly Published

2024-05-08 (about 1 year ago)

Added

2024-05-08 (about 1 year ago)

Last Updated

2025-01-22 (about 10 months ago)

Other

Published

Title

Published

2023-10-02

Title

Cooked < 1.7.15.1 - Contributor+ Stored XSS

Published

2025-08-13

Title

Authentication and xmlrpc log writer <= 1.2.2 - Reflected Cross-Site Scripting

Published

2025-08-21

Title

Better Post & Filter Widgets for Elementor < 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-08-14

Title

Plugin README Parser <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via target Parameter

Published

2025-06-05

Title

StageShow <= 10.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor Parameter