PT-2021-15950 · WordPress · Smooth Scroll Page Up/Down Buttons

M0Ze + 1 · Published 2021-07-12 · Updated 2021-07-15 · CVE-2021-24418

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Smooth Scroll Page Up/Down Buttons WordPress plugin versions 1.4 and earlier

Description The issue allows high privilege users, such as admins, to set an XSS payload in the psb positioning settings, which will be executed in all pages of the blog. This occurs due to the plugin's failure to properly sanitise and validate its settings.

Recommendations For Smooth Scroll Page Up/Down Buttons WordPress plugin versions 1.4 and earlier, update to a version that properly sanitises and validates the psb positioning settings to prevent XSS payload execution.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24418

Affected Products

Smooth Scroll Page Up/Down Buttons

References · 5

• 🔥 https://wpscan.com/vulnerability/1512bba9-89e2-493d-b85d-10c7acb903db · Exploit
• 🔥 https://m0ze.ru/vulnerability/[2021-04-29]-[WordPress]-[CWE-79]-Smooth-Scroll-Page-UpDown-Buttons-WordPress-Plugin-v1.4.txt · Exploit
• https://osv.dev/vulnerability/CVE-2021-24418 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24418 · Security Note
• https://m0ze.ru/vulnerability/%5B2021-04-29%5D-%5BWordPress%5D-%5BCWE-79%5D-Smooth-Scroll-Page-UpDown-Buttons-WordPress-Plugin-v1.4.txt · Note