PT-2021-15928 · WordPress · Embed Youtube Video Wordpress Plugin

Syed Sheeraz Ali · Published 2021-09-06 · Updated 2021-09-09 · CVE-2021-24395

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Embed Youtube Video WordPress plugin versions 1.0 and earlier

Description The issue arises from the editid GET parameter not being sanitized, escaped, or validated before being inserted into a SQL statement, leading to SQL injection.

Recommendations For Embed Youtube Video WordPress plugin versions 1.0 and earlier, consider updating to a version where the editid parameter is properly sanitized to prevent SQL injection. As a temporary workaround, consider restricting access to the API endpoint that utilizes the editid parameter until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24395

Affected Products

Embed Youtube Video Wordpress Plugin

References · 5

• 🔥 https://codevigilant.com/disclosure/2021/wp-plugin-embed-youtube-video · Exploit
• 🔥 https://wpscan.com/vulnerability/6cd9ebcf-e78f-4f97-a8f9-b7e4ceab66b7 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24395 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24395 · Security Note
• https://t.me/cibsecurity/28278 · Telegram Post