PT-2021-15842 · WordPress · Target First Wordpress Plugin

Darkpills + 1 · Published 2021-05-24 · Updated 2021-05-28 · CVE-2021-24305

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Target First WordPress Plugin version 2.0

Description The issue is related to a critical unauthenticated stored XSS vulnerability. An attacker can modify the licence key value by sending a POST request to any URL with the weeWzKey parameter, which is then saved as the weeID option without proper sanitization.

Recommendations For version 2.0, consider disabling the licence key modification functionality until a patch is available to prevent exploitation of the stored XSS vulnerability. Restrict access to any URL that accepts the weeWzKey parameter to minimize the risk of exploitation. Avoid using the weeWzKey parameter in POST requests until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24305

Affected Products

Target First Wordpress Plugin

References · 4

• 🔥 https://wpscan.com/vulnerability/4d55d1f5-a7b8-4029-942d-7a13e2498f64 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24305 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24305 · Vendor Advisory
• https://targetfirst.com · Vendor Advisory