PT-2021-15772 · Patreon · Patreon Wordpress Plugin

Benedict Singer + 5 · Published 2021-04-12 · Updated 2021-04-14 · CVE-2021-24228

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Patreon WordPress plugin versions prior to 1.7.2

Description: A Reflected Cross-Site Scripting issue was identified in the Login Form of the Patreon WordPress plugin. The plugin hooks into the WordPress login form, allowing users to authenticate using their Patreon account. However, error logging logic allowed user-controlled input to be reflected on the login page without proper sanitization.

Recommendations: For versions prior to 1.7.2, update to version 1.7.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the login form until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24228

Affected Products

Patreon Wordpress Plugin

References · 4

• 🔥 https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin · Exploit
• https://osv.dev/vulnerability/CVE-2021-24228 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24228 · Security Note
• https://wpscan.com/vulnerability/7a5fadb1-3f1c-4779-8ff6-356fccb5269b · Note