KN Fix Your Title <= 1.0.1 – Authenticated Stored XSS | CVE 2021-24547 | Plugin Vulnerabilities

Description

The plugin was vulnerable to Authenticated Stored XSS in the separator field.

Proof of Concept

1. Install WordPress 5.7.2
2. Install and activate KN Fix Your Title
3. Navigate to Fix Title under Settings Tab >> Click on I have done this and enter the XSS payload into the Separator input field.
4. Click Save Changes.
5. You will observe that the payload successfully got stored into the database and when you are triggering the same functionality at that time JavaScript payload is executing successfully and we are getting a pop-up.
6. Payload Used: "><script>alert(document.cookie)</script>

Affects Plugins

No known fix

References

CVE

Exploitdb

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Aakash Choudhary

Submitter website

https://attacker-codeninja.github.io

Submitter twitter

Verified

No

WPVDB ID

faaeb685-ea02-4a5a-ac5f-87081efe94e0

Timeline

Publicly Published

2021-07-20 (about 4 years ago)

Added

2021-07-20 (about 4 years ago)

Last Updated

2023-01-23 (about 2 years ago)

Other

Published

Title

Published

2025-09-02

Title

Today's Date Inserter <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2021-11-23

Title

Paid Memberships Pro < 2.6.6 - Reflected Cross-Site Scripting

Published

2022-11-17

Title

News Announcement Scroll < 9.0.0 - Admin+ Stored XSS

Published

2025-10-24

Title

Listeo < 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via soundcloud Shortcode

Published

2022-03-15

Title

Post Grid < 2.1.16 - Reflected Cross-Site Scripting via post_types