PT-2021-15674 · WordPress · Themify Portfolio Post

Nguyen Anh Tien · Published 2021-03-18 · Updated 2021-03-24 · CVE-2021-24129

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Themify Portfolio Post WordPress plugin versions prior to 1.1.6

Description: The issue arises from unvalidated input and a lack of output encoding in the Themify Portfolio Post WordPress plugin, leading to Stored Cross-Site Scripting (XSS) vulnerabilities. This allows low-privileged users, such as those with Contributor+ permissions, to inject arbitrary JavaScript code or HTML into posts where the Themify Custom Panel is embedded. This could potentially lead to privilege escalation.

Recommendations: For versions prior to 1.1.6, update to version 1.1.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the Themify Custom Panel for low-privileged users until the update can be applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24129

Affected Products

Themify Portfolio Post

References · 5

• 🔥 https://wpscan.com/vulnerability/c8537e5f-1948-418b-9d29-3cf50cd8f9a6 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24129 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24129 · Security Note
• https://t.me/cvenotify/11532 · Telegram Post
• https://t.me/cibsecurity/25101 · Telegram Post