PT-2021-15882 · WordPress · Stock In & Out

Shreya Pohekar · Published 2021-06-14 · Updated 2021-06-21 · CVE-2021-24346

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Stock in & out WordPress plugin versions 1.0.0 through 1.0.4

Description The issue concerns a reflected XSS problem due to the lack of validation, sanitization, or escaping of the srch POST parameter in the search functionality. This functionality is accessible to contributors, which is the lowest accessible level.

Recommendations For Stock in & out WordPress plugin versions 1.0.0 through 1.0.4, consider disabling the search functionality until a patch is available to prevent exploitation of the reflected XSS issue. Restrict access to the contributor level to minimize the risk of exploitation. Avoid using the srch parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24346

Affected Products

Stock In & Out

References · 4

• 🔥 https://wpscan.com/vulnerability/c25146fd-4143-463c-8c85-05dd33e9a77b · Exploit
• 🔥 https://codevigilant.com/disclosure/2021/wp-plugin-stock-in · Exploit
• https://osv.dev/vulnerability/CVE-2021-24346 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24346 · Security Note