cve/2021/CVE-2021-24334.md

### [CVE-2021-24334](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24334)
![](https://img.shields.io/static/v1?label=Product&message=Instant%20Images%20%E2%80%93%20One%20Click%20Unsplash%20Uploads&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=4.4.0.1%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-site%20Scripting%20(XSS)&color=brightgreen)

### Description

The Instant Images – One Click Unsplash Uploads WordPress plugin before 4.4.0.1 did not properly validate and sanitise its unsplash_download_w and unsplash_download_h parameter settings (/wp-admin/upload.php?page=instant-images), only validating them client side before saving them, leading to a Stored Cross-Site Scripting issue.

### POC

#### Reference
- https://wpscan.com/vulnerability/ae79189a-6b63-4110-9567-cd7c97d71e4f

#### Github
- https://github.com/20142995/nuclei-templates