Security readout for executives and security teams
Plain-English summary
This issue affects the WP Config File Editor WordPress plugin through version 1.7.1. An authenticated user could store malicious browser-executed content, creating risk to administrators or other users who later view the affected area.
Executive priority
Handle as a near-term WordPress hygiene item. Prioritize internet-facing, business-critical, or multi-user WordPress sites. Urgency is reduced by authenticated access requirements and no cited active exploitation, but stored XSS can still affect privileged users.
Technical view
CVE-2021-24367 is an authenticated stored cross-site scripting vulnerability in WP Config File Editor through 1.7.1, mapped to CWE-79. The provided sources do not include CVSS, affected privilege details, proof of exploitation, or a named fixed version.
Likely exposure
Exposure is likely limited to WordPress sites running WP Config File Editor version 1.7.1 or earlier, especially where multiple users can access plugin-related configuration or administration functions.
Exploitation context
The source bundle describes authenticated stored XSS only. It is not listed as CISA KEV, and the provided sources do not support a claim of active exploitation in the wild.
Researcher notes
Evidence is sparse. The available record confirms product, version boundary, vulnerability class, and authenticated stored XSS description, but not exploit primitives, affected parameters, CVSS, or remediation version. Avoid assumptions beyond WP Config File Editor through 1.7.1.
Mitigation direction
- Inventory WordPress sites for WP Config File Editor installations.
- Remove or disable the plugin where it is not business-critical.
- Check vendor or WPScan guidance for a fixed version or replacement path.
- Restrict WordPress administrative access to trusted users only.
- Review least-privilege role assignments for plugin configuration access.
Validation and detection
- Confirm whether WP Config File Editor is installed on each WordPress site.
- Record the installed plugin version and flag versions through 1.7.1.
- Review plugin access permissions for non-administrator users.
- Check recent administrative activity for unexpected plugin configuration changes.
- Use safe vulnerability scanning; avoid live exploit payload testing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-24367 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/f35b7c8f-cfb6-42b6-8a3a-8c07cd1e9da0CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.