CVE-2021-24794

4.8 mediumEPSS 0.7%

Medium (4.8) in connections-pro connections business directory. EPSS 0.7% chance of exploitation in the next 30 days.

The Connections Business Directory WordPress plugin before 10.4.3 does not escape the Address settings when creating an Entry, which could allow high privilege users to perform Cross-Site Scripting when the unfiltered_html capability is disallowed.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-11-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

connections-pro:connections_business_directory

References

https://wpscan.com/vulnerability/651dc567-943e-4f57-8ec4-6eee466785f5
https://wpscan.com/vulnerability/651dc567-943e-4f57-8ec4-6eee466785f5

Check your stack JSON