cve/2021/CVE-2021-24246.md

### [CVE-2021-24246](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24246)
![](https://img.shields.io/static/v1?label=Product&message=WorkScout&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Workscout%20Core&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=1.3.4%3C%201.3.4%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=2.0.33%3C%202.0.33%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-site%20Scripting%20(XSS)&color=brighgreen)

### Description

The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX action, leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues

### POC

#### Reference
- https://wpscan.com/vulnerability/2365a9d0-f6f4-4602-9804-5af23d0cb11d

#### Github
No PoCs found on GitHub currently.