Security readout for executives and security teams
Plain-English summary
Project Status for WordPress through version 1.6 can reflect untrusted input into an error message. That can let an attacker run browser-side script in a victim's session if the vulnerable path is reached. The source bundle does not provide a CVSS score, confirmed exploit activity, or a fixed version.
Executive priority
Prioritize discovery first. This is a browser-side risk in a WordPress plugin, but the available sources do not prove exploitation or provide severity scoring. Sites using Project Status through 1.6 should plan removal, replacement, or vendor-confirmed update promptly.
Technical view
The pspin_duplicate_post_save_as_new_post function fails to sanitize, validate, or escape the post GET parameter before outputting it when a related post is missing. This is CWE-79 reflected XSS affecting Project Status through 1.6. Patch status is not established in the provided sources.
Likely exposure
Exposure is limited to WordPress sites with the Project Status plugin installed at version 1.6 or earlier. The affected code path involves the duplicate/save-as-new-post handling and an error response for a missing related post.
Exploitation context
The bundle describes reflected XSS but provides no CVSS score and no evidence of active exploitation. CISA KEV status is false. Treat exploitability as plausible where an attacker can influence a victim to reach the vulnerable URL, but the exact access requirements are not confirmed here.
Researcher notes
Key evidence is the vulnerable function name and unsanitized post GET parameter reflected in an error message. The bundle lacks authentication requirements, privilege context, nonce behavior, affected route details, CVSS data, and fixed-version information, so validation should avoid assumptions.
Mitigation direction
- Inventory WordPress sites for the Project Status plugin and version.
- Check WPScan, the plugin vendor, or repository guidance for a fixed release.
- If no fixed release exists, disable or remove the plugin until resolved.
- Restrict access to administrative WordPress paths where practical.
- Monitor web logs for unusual requests involving the post parameter.
Validation and detection
- Confirm whether Project Status version 1.6 or earlier is installed.
- Review the plugin code path for unescaped output of the post GET parameter.
- Use a controlled staging test with harmless markers only.
- Verify whether vendor guidance identifies a patched version or workaround.
- Check security tooling for CVE-2021-24558 or the WPScan identifier.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-24558 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/ca5f2152-fcfd-492d-a552-f9604011beffCVE reference · x_refsource_MISC
- https://codevigilant.com/disclosure/2021/wp-plugin-project-status/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.