PT-2021-15955 · WordPress · Mystickymenu

M0Ze + 1 · Published 2021-08-02 · Updated 2021-08-10 · CVE-2021-24425

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions myStickymenu WordPress plugin versions prior to 2.5.2

Description The issue allows high privilege users to use malicious JavaScript in the Bar Text settings, leading to a Stored Cross-Site Scripting issue. This issue will be triggered in the plugin's setting, as well as all front-page of the blog when the Welcome bar is active.

Recommendations For versions prior to 2.5.2, update to version 2.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Bar Text settings to prevent high privilege users from injecting malicious JavaScript.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24425

Affected Products

Mystickymenu

References · 6

• 🔥 https://wpscan.com/vulnerability/14632fa8-597e-49ff-8583-9797208a3583 · Exploit
• 🔥 https://m0ze.ru/vulnerability/[2021-05-21]-[WordPress]-[CWE-79]-MyStickymenu-WordPress-Plugin-v2.5.1.txt · Exploit
• https://osv.dev/vulnerability/CVE-2021-24425 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24425 · Security Note
• https://m0ze.ru/vulnerability/%5B2021-05-21%5D-%5BWordPress%5D-%5BCWE-79%5D-MyStickymenu-WordPress-Plugin-v2.5.1.txt · Note
• https://t.me/cvenotify/18957 · Telegram Post