PT-2021-15867 · Cartflows · The Funnel Builder By Cartflows

M0Ze + 1 · Published 2021-06-01 · Updated 2023-08-09 · CVE-2021-24330

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin versions prior to 1.6.13

Description The issue concerns the plugin's failure to sanitize its facebook pixel id and google analytics id settings, allowing high-privilege users to set XSS payload in them. This can lead to the execution of the payload on pages generated by the plugin or the whole website, depending on the settings used.

Recommendations For versions prior to 1.6.13, update to version 1.6.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the facebook pixel id and google analytics id settings to prevent high-privilege users from setting XSS payloads.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24330

Affected Products

The Funnel Builder By Cartflows

References · 5

• 🔥 https://m0ze.ru/vulnerability/[2021-04-26]-[WordPress]-[CWE-79]-Funnel-Builder-by-CartFlows-WordPress-Plugin-v1.6.12.txt · Exploit
• 🔥 https://wpscan.com/vulnerability/b9748066-83b7-4762-9124-de021f687477 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24330 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24330 · Security Note
• https://m0ze.ru/vulnerability/%5B2021-04-26%5D-%5BWordPress%5D-%5BCWE-79%5D-Funnel-Builder-by-CartFlows-WordPress-Plugin-v1.6.12.txt · Note