Read the docs
TI-2021-06569 Aliases CVE-2021-24277GHSA-58vx-vc62-43fr

RSS for Yandex Turbo < 1.30 - Authenticated Stored Cross-Site Scripting (XSS)

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The RSS for Yandex Turbo WordPress plugin before 1.30 did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in the page, leading to authenticated stored Cross-Site Scripting issues

Why it matters now

EPSS 0.0062 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed RSS for Yandex Turbo (Flector): 1.30

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
FlectorRSS for Yandex Turbo1.30 to before 1.301.30Patch availableCNA
  • RSS for Yandex Turbo VendorFlector Affected 1.30 to before 1.30 Fixed in 1.30 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wpuslugi:rss_for_yandex_turbo:*:*:*:*:*:wordpress:*:*before 1.30VulnerableWpuslugi
  • cpe:2.3:a:wpuslugi:rss_for_yandex_turbo:*:*:*:*:*:wordpress:*:* Versions before 1.30 Vulnerable ·Wpuslugi

Remediation

  • Fix · CNA RSS for Yandex Turbo (Flector) Fixed in 1.30

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24277
  2. 2026-10-03 Alias added: GHSA-58vx-vc62-43fr

References

Exploit 1

  • TI-2024-21413 WordPress Easy Textillate plugin <= 2.02 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
  • TI-2024-02140 Easy Textillate <= 2.01 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 3.1MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences