Security readout for executives and security teams
Plain-English summary
Easy Preloader for WordPress through 1.0.0 lets an administrator save unsafe content in plugin settings, causing stored cross-site scripting. The provided sources do not describe unauthenticated compromise or active exploitation, but persistent browser-side risk can still matter on managed WordPress sites.
Executive priority
Treat as a targeted WordPress hygiene issue, not an emergency internet-wide event based on available evidence. Prioritize sites with many admins, third-party site managers, or weak admin account controls.
Technical view
The plugin fails to sanitize setting fields, creating authenticated admin-plus stored XSS. The CVE maps to CWE-79. No CVSS score, CPE, exploit details, or fixed version is provided in the source bundle, so remediation should be guided by vendor or plugin-maintainer information.
Likely exposure
WordPress sites running Easy Preloader through version 1.0.0 are in scope. Exposure is most relevant where multiple administrators manage settings, admin accounts are shared, or admin access may be compromised. No other affected products are identified in the sources.
Exploitation context
The source bundle does not report exploitation in the wild, and KEV is false. The attacker prerequisite is authenticated admin-level access, which reduces broad internet exposure but does not eliminate risk in delegated, agency-managed, or already-compromised WordPress environments.
Researcher notes
Evidence is concise: unsanitized setting fields produce authenticated stored XSS in Easy Preloader through 1.0.0. The sources do not provide a patch version, proof-of-concept details, CVSS vector, or observed exploitation evidence.
Mitigation direction
- Check vendor or plugin-maintainer guidance for an updated safe version.
- Disable or remove Easy Preloader if no maintained fix is available.
- Restrict WordPress administrator access to trusted, necessary users only.
- Review plugin settings for unexpected unsafe HTML or script-like content.
Validation and detection
- Inventory WordPress sites for the Easy Preloader plugin.
- Confirm whether installed versions are through 1.0.0.
- Review administrator accounts with permission to change plugin settings.
- Check security monitoring for suspicious WordPress admin setting changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-24344 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/6d6c1d46-5c3d-4d56-9728-2f94064132aaCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.