Security readout for executives and security teams
Plain-English summary
A logged-in WordPress user could store malicious script through the Pods plugin Menu Label field. That script could later run in another user's browser, creating risk to admin sessions and site integrity. The sources do not report public exploitation or a CVSS score.
Executive priority
Treat as a routine but real web application risk. Prioritize remediation on public or business-critical WordPress sites, and where many authenticated users have content or configuration access.
Technical view
CVE-2021-24339 is an authenticated stored XSS issue in Pods - Custom Content Types and Fields before 2.7.27. The vulnerable input is the Menu Label field parameter. It is classified as CWE-79. Available sources identify the issue and affected plugin version boundary but provide limited technical detail.
Likely exposure
Exposure is limited to WordPress sites using the Pods plugin before 2.7.27, especially where non-administrator users can access affected Pods configuration fields.
Exploitation context
The source bundle does not show KEV listing or cited evidence of active exploitation. Because this is authenticated stored XSS, exploitation requires a logged-in user with access to the affected field and a later victim viewing the stored content.
Researcher notes
Evidence is limited to public CVE/WPScan-style records. No CVSS vector, detailed privilege requirement, affected role, or exploit-in-the-wild evidence is provided in the source bundle. Avoid assuming unauthenticated reachability or broader product impact.
Mitigation direction
- Upgrade Pods to 2.7.27 or a later vendor-supported release.
- Restrict access to Pods configuration screens to trusted administrators.
- Review existing Menu Label values for unexpected or unsafe content.
- Monitor vendor advisories for any additional guidance.
Validation and detection
- Inventory WordPress sites for the Pods plugin and recorded version.
- Confirm exposed installations are not running versions before 2.7.27.
- Review user roles allowed to edit Pods menu labels or configuration.
- Check admin activity records for unexpected Pods configuration changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-24339 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/8e72236d-f620-4503-a324-dcf49405351bCVE reference · x_refsource_CONFIRM
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-24339CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.