CVE-2021-24897: Viitorcloud Add Subtitle

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

The Add Subtitle WordPress plugin through 1.1.0 does not sanitise or escape the sub-title field (available only with classic editor) when output in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks

Affected products

• Viitorcloud Add Subtitle: up to and including 1.1.0

Published 2022-03-14. Last modified 2026-06-17.