Admin Columns Free (< 4.3.2) & Pro (< 5.5.2) - Authenticated Stored Cross-Site Scripting (XSS) in Custom Field
Priority LOW 26CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
The Admin Columns WordPress plugin Free before 4.3.2 and Pro before 5.5.2 allowed to configure individual columns for tables. Each column had a type. The type "Custom Field" allowed to choose an arbitrary database column to display in the table. There was no escaping applied to the contents of "Custom Field" columns.
Why it matters now
EPSS 0.00932 60th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Admin Columns (AdminColumns): 4.3.2Admin Columns Pro (AdminColumns): 5.5.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AdminColumns | Admin Columns | 4.3.2 to before 4.3.2 | 4.3.2 | Patch available | CNA |
| AdminColumns | Admin Columns Pro | 5.5.2 to before 5.5.2 | 5.5.2 | Patch available | CNA |
- Admin Columns VendorAdminColumns Affected 4.3.2 to before 4.3.2 Fixed in 4.3.2 Patch available CNA
- Admin Columns Pro VendorAdminColumns Affected 5.5.2 to before 5.5.2 Fixed in 5.5.2 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:admincolumns:admin_columns:*:*:*:*:free:wordpress:*:* | before 4.3.2 | Vulnerable | AdminColumns |
| cpe:2.3:a:admincolumns:admin_columns:*:*:*:*:pro:wordpress:*:* | before 5.5.2 | Vulnerable | AdminColumns |
- cpe:2.3:a:admincolumns:admin_columns:*:*:*:*:free:wordpress:*:* Versions before 4.3.2 Vulnerable ·AdminColumns
- cpe:2.3:a:admincolumns:admin_columns:*:*:*:*:pro:wordpress:*:* Versions before 5.5.2 Vulnerable ·AdminColumns
Remediation
- Fix · CNA Admin Columns (AdminColumns) Fixed in 4.3.2
- Fix · CNA Admin Columns Pro (AdminColumns) Fixed in 5.5.2
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24365
- 2026-10-03 Alias added: GHSA-q7j6-278p-wvrh
References
More AdminColumns Admin Columns vulnerabilities
- TI-2021-06658 Admin Columns Free < 4.3 & Pro < 5.5.1 - Admin+ Stored XSS in Label CVSS 3.1MEDIUM 5.4
- TI-2019-13183 A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for… CVSS 3.1HIGH 8.8
Sources
- CVE-2021-24365 · CVE Program
- CVE-2021-24365 · NVD
- FIRST EPSS
- GHSA-q7j6-278p-wvrh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences