medium5.4
CVE-2021-24283
The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.
Impact
The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pickplugins | Accordion | before 2.2.30 |