PT-2021-15817 · WordPress · Rss For Yandex Turbo

Himamshu Dilip Kulkarni · Published 2021-05-14 · Updated 2021-05-21 · CVE-2021-24277

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RSS for Yandex Turbo WordPress plugin versions prior to 1.30

Description The issue arises from improper sanitization of user inputs from the Счетчики settings tab, leading to authenticated stored Cross-Site Scripting issues.

Recommendations For versions prior to 1.30, update to version 1.30 or later to resolve the issue. As a temporary workaround, consider restricting access to the Счетчики settings tab to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24277

Affected Products

Rss For Yandex Turbo

References · 5

• 🔥 https://wpscan.com/vulnerability/8ebf56be-46c0-4435-819f-dc30370eafa4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24277 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24277 · Vendor Advisory
• https://t.me/cvenotify/14428 · Telegram Post
• https://t.me/cvenotify/14838 · Telegram Post