CVE-2021-24342 – JNews < 8.0.6 - Reflected Cross-Site Scripting (XSS)

https://notcve.org/view.php?id=CVE-2021-24342

The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue. El tema de WordPress JNews versiones anteriores a 8.0.6, no saneaba el parámetro cat_id en una petición POST/?ajax-request=jnews (with action=jnews_build_mega_category_*), conllevando a un problema de tipo Cross-Site Scripting (XSS) Reflejado • https://wpscan.com/vulnerability/415ca763-fe65-48cb-acd3-b375a400217e • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •