CVE-2021-39354

Опубликовано: 21 окт. 2021

Источник: nvd

CVSS3: 4.8

CVSS2: 3.5

EPSS Низкий

Описание

The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end_date parameters found in the ~/includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2.

Ссылки

https://github.com/BigTiger2020/word-press/blob/main/Easy%20Digital%20Downloads.md
Exploit
Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2616149/easy-digital-downloads/trunk/includes/admin/payments/class-payments-table.php
Patch
Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39354
Third Party Advisory
https://github.com/BigTiger2020/word-press/blob/main/Easy%20Digital%20Downloads.md
Exploit
Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2616149/easy-digital-downloads/trunk/includes/admin/payments/class-payments-table.php
Patch
Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39354
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:awesomemotive:easy_digital_downloads:*:*:*:*:*:wordpress:*:*

Версия до 2.11.2 (включая)

EPSS

Процентиль: 54%

0.0031

Низкий

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79