PT-2021-16038 · WordPress · Planso Forms

Felipe Restrepo Rodriguez · Published 2021-10-18 · Updated 2021-10-21 · CVE-2021-24516

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PlanSo Forms WordPress plugin versions 2.6.3 and earlier

Description The issue allows high privilege users, such as admins, to set an XSS payload in the title of a form, leading to an Authenticated Stored Cross-Site Scripting issue, even when the unfiltered html is disallowed. This occurs because the title of the form is not properly escaped before being outputted in attributes.

Recommendations For PlanSo Forms WordPress plugin versions 2.6.3 and earlier, update to a version later than 2.6.3 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24516

Affected Products

Planso Forms

References · 4

• 🔥 https://wpscan.com/vulnerability/88d70e35-4c22-4bc7-b1a5-24068d55257c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24516 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24516 · Vendor Advisory
• https://t.me/cibsecurity/30713 · Telegram Post