Security readout for executives and security teams
Plain-English summary
Admin Columns for WordPress had a stored XSS flaw in label settings. A privileged user, such as an admin, could save unsafe content that later runs in another user’s browser, including in multisite environments where unfiltered HTML is meant to be blocked.
Executive priority
Handle during normal vulnerability remediation, faster for shared or multisite WordPress environments. Business impact is mainly administrative browser compromise and trust boundary erosion, not unauthenticated site takeover based on the provided evidence.
Technical view
CVE-2021-24366 is CWE-79 in Admin Columns Free before 4.3 and Admin Columns Pro before 5.5.1. Label settings were not properly sanitized and escaped, enabling stored cross-site scripting by authenticated high-privilege users. CVSS 3.1 is 5.4 with low complexity, low privileges, user interaction required, and changed scope.
Likely exposure
Exposure is limited to WordPress sites using affected Admin Columns versions, especially multisite installations relying on unfiltered_html restrictions. Risk depends on who has access to configure column labels and who later views affected admin pages.
Exploitation context
The source bundle includes a WPScan reference tagged exploit, but KEV is false and the provided sources do not show active in-the-wild exploitation. Treat this as a known, public WordPress plugin issue, not a confirmed active campaign.
Researcher notes
Key constraints are privilege and user interaction. The issue bypasses expected HTML restrictions for high-privilege users when labels render later. The supplied CPE/version metadata is sparse, so rely on plugin name and fixed-version checks rather than CPE matching alone.
Mitigation direction
- Upgrade Admin Columns Free to 4.3 or later.
- Upgrade Admin Columns Pro to 5.5.1 or later.
- Review vendor guidance and the linked patch for exact remediation details.
- Restrict plugin configuration access to trusted administrators only.
- Inspect existing label settings for unexpected markup or script-like content.
Validation and detection
- Inventory WordPress sites for Admin Columns Free and Pro installations.
- Confirm installed versions are not below the fixed releases.
- Review multisite deployments where unfiltered_html is intentionally disabled.
- Check admin column label settings for unsafe saved content.
- Verify rendered admin labels are sanitized and escaped after update.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-24366 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N2.32.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/05427156-4d5c-4aeb-add8-1c574fda5c28CVE reference · exploit, vdb-entry
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-24366CVE reference
- https://github.com/codepress/admin-columns/commit/b45571ed21d574d13687213a5002e0c68e4442c7CVE reference · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.