PT-2021-15741 · WordPress · Social Slider Widget

Purine Chu · Published 2021-04-05 · Updated 2021-04-09 · CVE-2021-24196

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: The Social Slider Widget WordPress plugin versions prior to 1.8.5

Description: The issue allows Authenticated Reflected XSS in the plugin settings page. The token error parameter can be controlled by users and is directly echoed without being sanitized.

Recommendations: For versions prior to 1.8.5, update to version 1.8.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin settings page to minimize the risk of exploitation. Avoid using the token error parameter in the affected settings page until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24196

Affected Products

Social Slider Widget

References · 5

• 🔥 https://purinechu.github.io/posts/social_slider_widget_reflected_xss · Exploit
• 🔥 https://wpscan.com/vulnerability/bb20d732-a5e4-4140-ab51-b2aa1a53db12 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24196 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24196 · Security Note
• https://t.me/cvenotify/12670 · Telegram Post