Security readout for executives and security teams
Plain-English summary
CVE-2021-24309 is a stored cross-site scripting issue in the Weekly Schedule WordPress plugin. In versions before 3.4.3, the Schedule Name field did not properly sanitize script input. An authenticated user could store malicious JavaScript that later runs in another user's browser.
Executive priority
Treat this as a targeted WordPress plugin hygiene issue, not an emergency internet-wide compromise signal. Prioritize patching exposed WordPress sites where non-admin users can access plugin settings or where administrative sessions are high value.
Technical view
The vulnerability is CWE-79 in the Weekly Schedule plugin's general options handling. The Schedule Name input accepted unsanitized script tags, creating authenticated stored XSS before version 3.4.3. The bundle provides no CVSS score, exploit proof, privilege detail, or affected WordPress role requirements.
Likely exposure
Exposure is likely limited to WordPress sites that installed Weekly Schedule and still run a version earlier than 3.4.3. Risk depends on which authenticated roles can edit the plugin's general options or Schedule Name field.
Exploitation context
The supplied sources do not indicate active exploitation, and the CVE is not listed as KEV in the bundle. Exploitation requires authenticated access and the ability to save the affected Schedule Name value, but stored XSS can affect later administrative or user sessions.
Researcher notes
Key unknowns are the exact minimum role required, CVSS severity, and whether later advisories refined affected versions. The source bundle supports the root cause and fixed-threshold statement, but not active exploitation or weaponized availability.
Mitigation direction
- Upgrade Weekly Schedule to version 3.4.3 or later.
- Check WPScan or vendor guidance for current fixed-version information.
- Restrict plugin settings access to trusted administrators.
- Review saved schedule names and remove suspicious script-like content.
Validation and detection
- Inventory WordPress sites for the Weekly Schedule plugin.
- Confirm installed plugin versions are 3.4.3 or later.
- Review roles permitted to modify Weekly Schedule general options.
- Check existing Schedule Name values for unexpected HTML or script content.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-24309 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/ba1d01dc-16e4-464f-94be-ed311ff6ccf9CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.