{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"4.2.1"}],"component":"intelliants/subrion","cve_ids":["CVE-2021-41948"],"ecosystem":"Packagist","epss":0.00487,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-jv64-2m3x-6v4q","id":"tcs_01M5KF4W67MQGT15DS5PXH10QM","modified_at":"2024-02-20T05:33:09.792016Z","published_at":"2022-04-30T00:00:36Z","references":["https://osv.dev/vulnerability/GHSA-jv64-2m3x-6v4q","https://nvd.nist.gov/vuln/detail/CVE-2021-41948","https://github.com/intelliants/subrion-plugin-contact_us/issues/8","https://github.com/intelliants/subrion-plugin-contact_us"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-jv64-2m3x-6v4q","url":"https://osv.dev/vulnerability/GHSA-jv64-2m3x-6v4q"}],"summary":"Subrion CMS Cross-site Scripting (XSS) vulnerability in the `contact us` plugin"}