Admin Columns Free < 4.3 & Pro < 5.5.1 - Admin+ Stored XSS in Label
Priority MEDIUM 58Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
The Admin Columns WordPress plugin before 4.3 and Admin Columns Pro WordPress plugin before 5.5.1 do not sanitise and escape its Label settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00997 62nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix Fixed Admin Columns (Unknown): 4.3Admin Columns Pro (Unknown): 5.5.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Admin Columns | 3.0 to before 4.3 | 4.3 | Patch available | CNA |
| Unknown | Admin Columns Pro | before 5.5.1 | 5.5.1 | Patch available | CNA |
- Admin Columns VendorUnknown Affected 3.0 to before 4.3 Fixed in 4.3 Patch available CNA
- Admin Columns Pro VendorUnknown Affected before 5.5.1 Fixed in 5.5.1 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:admincolumns:admin_columns:*:*:*:*:free:wordpress:*:* | before 4.3 | Vulnerable | AdminColumns |
| cpe:2.3:a:admincolumns:admin_columns:*:*:*:*:pro:wordpress:*:* | before 5.5.1 | Vulnerable | AdminColumns |
- cpe:2.3:a:admincolumns:admin_columns:*:*:*:*:free:wordpress:*:* Versions before 4.3 Vulnerable ·AdminColumns
- cpe:2.3:a:admincolumns:admin_columns:*:*:*:*:pro:wordpress:*:* Versions before 5.5.1 Vulnerable ·AdminColumns
Remediation
- Fix · CNA Admin Columns (Unknown) Fixed in 4.3
- Fix · CNA Admin Columns Pro (Unknown) Fixed in 5.5.1
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24366
- 2026-10-03 Alias added: GHSA-hrfw-7pg5-g3x6
References
More AdminColumns Admin Columns vulnerabilities
- TI-2019-13183 A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for… CVSS 3.1HIGH 8.8
- TI-2021-06657 Admin Columns Free (< 4.3.2) & Pro (< 5.5.2) - Authenticated Stored Cross-Site Scripting (XSS) in Custom Field CVSS 3.1MEDIUM 5.4
Sources
- CVE-2021-24366 · CVE Program
- CVE-2021-24366 · NVD
- FIRST EPSS
- GHSA-hrfw-7pg5-g3x6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences