GCVE - cpe:2.3:a:flat_preloader_project:flat_preloader:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:flat_preloader_project:flat_preloader:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Flat Preloader Project (`462be8e4-41af-5c19-910b-f41ccd110be7`)
Product	Flat Preloader (`5e026e56-a91f-513d-843e-e05f41f47807`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-24789`	vulnerable	2026-06-08 05:30:39.241652	Flat Preloader < 1.5.5 - Admin+ Stored Cross-Site Scripting The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed Published: 2021-11-01T08:46:23.000Z Updated: 2024-08-03T19:42:17.177Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/e8550ccd-3898-4e27-aca9-ade89823ff4d	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-24685`	vulnerable	2026-06-08 05:30:39.008617	Flat Preloader < 1.5.4 - CSRF to Stored Cross-Site Scripting The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload (triggered either in the frontend or backend depending on the payload) Published: 2021-11-01T08:46:06.000Z Updated: 2024-08-03T19:42:15.987Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/972ecde8-3d44-4dd9-81e3-643d8737434f	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.