Security readout for executives and security teams
Plain-English summary
CVE-2021-24304 affects the Newsmag WordPress theme before version 5.0. A website using the affected theme may reflect attacker-controlled script content through an AJAX parameter, creating a phishing or session-risk scenario if a user follows a crafted link.
Executive priority
Handle as a moderate-priority WordPress exposure cleanup. It is not cited as actively exploited in the supplied sources, but public websites running old themes create recurring phishing and account-risk opportunities.
Technical view
The issue is unauthenticated reflected XSS caused by missing sanitization of the td_block_id parameter in the td_ajax_block AJAX action. The source bundle maps this to CWE-79 and identifies Newsmag versions before 5.0 as affected, but provides no CVSS score.
Likely exposure
Exposure is most likely on public WordPress sites running the Newsmag theme before 5.0. Because it is unauthenticated and on an AJAX action, internet-facing sites should be prioritized for version checks.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. Reflected XSS usually requires a victim to open a crafted URL or interact with attacker-controlled content, but the source bundle does not provide exploit prevalence evidence.
Researcher notes
Evidence is limited to the CVE description and WPScan reference. The affected boundary is described as Newsmag before 5.0, with no CVSS vector, no vendor named in the bundle, and no exploitation status beyond KEV=false.
Mitigation direction
- Upgrade Newsmag to version 5.0 or later where applicable.
- If upgrade is unavailable, check current vendor or WPScan guidance.
- Remove the theme if it is unused or unsupported.
- Restrict administrative sessions from untrusted links and external browsing.
- Monitor web logs for suspicious td_ajax_block requests.
Validation and detection
- Inventory WordPress sites using the Newsmag theme.
- Confirm installed Newsmag versions against the before-5.0 affected range.
- Review whether td_ajax_block is reachable on public sites.
- Check logs for unusual td_block_id parameter activity.
- Verify remediation by confirming a non-affected theme version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-24304 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/bb71f2f9-76bd-43f4-a8c9-35771dd28dffCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.