CVE-2021-24722

Опубликовано: 01 нояб. 2021

Источник: nvd

CVSS3: 4.8

CVSS2: 3.5

EPSS Низкий

Описание

The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Ссылки

https://wpscan.com/vulnerability/14b29450-2450-4b5f-8630-bb2cbfbd0a83
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/14b29450-2450-4b5f-8630-bb2cbfbd0a83
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:motopress:restaurant_menu:*:*:*:*:*:wordpress:*:*

Версия до 2.4.2 (исключая)

EPSS

Процентиль: 43%

0.00206

Низкий

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-pr9v-j68v-chg2

github

больше 3 лет назад

The Restaurant Menu by MotoPress WordPress plugin through 2.4.0 does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed