CVE-2021-25112

Опубликовано: 28 фев. 2022

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting

Ссылки

https://plugins.trac.wordpress.org/changeset/2659751
Release Notes
Third Party Advisory
https://wpscan.com/vulnerability/4aae2dd9-8d51-4633-91bc-ddb53ca3471c
Exploit
Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2659751
Release Notes
Third Party Advisory
https://wpscan.com/vulnerability/4aae2dd9-8d51-4633-91bc-ddb53ca3471c
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:i-plugins:whmcs_bridge:*:*:*:*:*:wordpress:*:*

Версия до 6.4b (исключая)

EPSS

Процентиль: 90%

0.05226

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-pv99-qp9p-g563