PT-2021-15902 · WordPress · Admin Columns Pro+1

Daniel Elkabes · Published 2021-06-21 · Updated 2023-11-07 · CVE-2021-24366

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Admin Columns WordPress plugin versions prior to 4.3 Admin Columns Pro WordPress plugin versions prior to 5.5.1

Description The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible due to the lack of sanitization and escaping of the Label settings. The vulnerability can be exploited even when the unfiltered html capability is disallowed, for example, in a multisite setup. An authenticated attacker can supply a crafted arbitrary script and execute it by exploiting improper input validation on the value passed into the Label parameter.

Recommendations For Admin Columns WordPress plugin versions prior to 4.3, update to version 4.3 or later. For Admin Columns Pro WordPress plugin versions prior to 5.5.1, update to version 5.5.1 or later. As a temporary workaround, consider restricting access to the Label settings to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2021-24366

Affected Products

Admin Columns

Admin Columns Pro

References · 6

• 🔥 https://wpscan.com/vulnerability/05427156-4d5c-4aeb-add8-1c574fda5c28 · Exploit
• 🔥 https://whitesourcesoftware.com/vulnerability-database/CVE-2021-24366 · Exploit
• https://github.com/codepress/admin-columns/commit/b45571ed21d574d13687213a5002e0c68e4442c7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-24366 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24366 · Vendor Advisory
• https://t.me/cvenotify/16613 · Telegram Post