PT-2021-16004 · WordPress · Hostel Wordpress Plugin

Abisheik M · Published 2021-08-02 · Updated 2021-08-10 · CVE-2021-24481

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Any Hostname WordPress plugin versions 1.0.0 through 1.0.6

Description The issue arises from the lack of sanitization or escaping of the "Allowed hosts" setting in the plugin, leading to an authenticated stored XSS issue. High privilege users can set XSS payloads in this setting.

Recommendations For versions 1.0.0 through 1.0.6, as a temporary workaround, consider restricting access to the "Allowed hosts" setting to prevent high privilege users from setting XSS payloads until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24481

Affected Products

Hostel Wordpress Plugin

References · 5

• 🔥 https://wpscan.com/vulnerability/a4c352de-9815-4dfe-ac51-65b5bfb37438 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24481 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24481 · Vendor Advisory
• https://t.me/cibsecurity/26655 · Telegram Post
• https://t.me/cvenotify/18986 · Telegram Post