CVE-2021-24334 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Instant Images – One Click Unsplash Uploads WordPress plugin prior to version 4.4.0.1. The flaw stems from insufficient server-side validation of the unsplash_download_w and unsplash_download_h parameters, allowing malicious scripts to be injected and stored. Rated as MEDIUM severity with a CVSS score of 5.4, this vulnerability requires low privileges and user interaction (UI:R) for exploitation, potentially leading to client-side information disclosure and integrity compromise. The attack vector is network-based (AV:N) with low attack complexity (AC:L). Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. The CVE has received minimal community discussion and media coverage, indicating a low level of public awareness or concern.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.4.0.1CPE matchmatch criteria | cpe:2.3:a:connekthq:instant_images_-_one_click_unsplash_uploads:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.