Back to Database
Status published
Medium
CVE-2021-24274
Ultimate Maps by Supsystic < 1.2.5 - Reflected Cross-Site scripting (XSS)
Vulnerability Description
The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-24274
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- 0xB9
References
More from Supsystic
View All →CVE-2024-47330
Broken Access Control vulnerability on multiple WordPress plugins by Supsystic
Medium
4.3
CVE-2024-33910
WordPress Digital Publications by Supsystic plugin <= 1.7.7 - Broken Access Control vulnerability
Medium
5.3
CVE-2024-32829
WordPress Data Tables Generator by Supsystic plugin <= 1.10.31 - Broken Access Control vulnerability
Medium
4.3
CVE-2024-32790
WordPress Pricing Table by Supsystic plugin <= 1.9.12 - Content Injection vulnerability
Medium
4.3
CVE-2024-32089
WordPress Digital Publications by Supsystic plugin <= 1.7.7 - Cross Site Request Forgery (CSRF) vulnerability
Medium
4.3
Affected Vendor
Supsystic
View all reports →Affected Software
Ultimate Maps by Supsystic
Vulnerable Versions:
1.2.5
Timeline
Official Publish:
May 5th, 2021
Last Modified:
August 3rd, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N