Vulnerability record · CVE-2021-24229 · published 12 April 2021
CVE-2021-24229: Patreon wordpress cross-site scripting vulnerability
Patreon · Patreon Wordpress
The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. This AJAX hook is used to update the pledge level required by Patreon subscribers to access a given attachment. This action is accessible for user accounts with the ‘manage_options’ privilege (i.e.., only administrators). Unfortunately, one of the parameters used in this AJAX endpoint is not sanitized before being printed back to the user, so the risk it represents is the same as the previous XSS vulnerability.
Description
The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. This AJAX hook is used to update the pledge level required by Patreon subscribers to access a given attachment. This action is accessible for user accounts with the ‘manage_options’ privilege (i.e.., only administrators). Unfortunately, one of the parameters used in this AJAX endpoint is not sanitized before being printed back to the user, so the risk it represents is the same as the previous XSS vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/ | ExploitThird Party Advisory |
| https://wpscan.com/vulnerability/001755c4-add3-4566-a022-ab1f83546c1f | Third Party Advisory |
| https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/ | ExploitThird Party Advisory |
| https://wpscan.com/vulnerability/001755c4-add3-4566-a022-ab1f83546c1f | Third Party Advisory |
Track CVE-2021-24229 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-24229), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
