PT-2021-15905 · WordPress · Getpaid

Jörg Steinsträter + 1 · Published 2021-06-21 · Updated 2021-06-25 · CVE-2021-24369

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GetPaid WordPress plugin versions prior to 2.3.4

Description The issue concerns the GetPaid WordPress plugin, where users with the contributor role and above can create a new Payment Form. However, the Label and Help Text input fields were not properly sanitized, allowing the injection of malicious content such as img tags. This leads to a Stored Cross-Site Scripting issue, which is triggered when the form is edited, for example, when an admin reviews it, and could lead to privilege escalation.

Recommendations For versions prior to 2.3.4, update to version 2.3.4 or later to resolve the issue. As a temporary workaround, consider restricting the ability of users with the contributor role and above to create new Payment Forms until the update is applied. Additionally, restrict access to the Label and Help Text input fields to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24369

Affected Products

Getpaid

References · 5

• 🔥 https://wpscan.com/vulnerability/1d1a731b-78f7-4d97-b40d-80f66700edae · Exploit
• https://osv.dev/vulnerability/CVE-2021-24369 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24369 · Security Note
• https://t.me/cvenotify/16611 · Telegram Post
• https://t.me/cibsecurity/25589 · Telegram Post