CVE-2021-24737

Опубликовано: 11 окт. 2021

Источник: nvd

CVSS3: 4.8

CVSS2: 3.5

EPSS Низкий

Описание

The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Ссылки

https://wpscan.com/vulnerability/f51a350c-c46d-4d52-b787-762283625d0b
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/f51a350c-c46d-4d52-b787-762283625d0b
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:gvectors:wpdiscuz:*:*:*:*:*:wordpress:*:*

Версия до 7.3.0 (включая)

EPSS

Процентиль: 51%

0.00282

Низкий

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-3cx9-v24x-52mr

github

больше 3 лет назад

The Comments â€“ wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.