PT-2021-16039 · WordPress · Stop Spammers Security

Swapnil Subhash Bodekar · Published 2021-09-06 · Updated 2021-09-09 · CVE-2021-24517

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin versions prior to 2021.18

Description The issue allows high privilege users, such as admins, to set Cross-Site Scripting payloads in some settings, even when the unfiltered html capability is disallowed. This is due to the plugin not escaping some of its settings.

Recommendations For versions prior to 2021.18, update to version 2021.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings for high privilege users until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24517

Affected Products

Stop Spammers Security

References · 4

• 🔥 https://wpscan.com/vulnerability/f440edd8-94fe-440a-8a5b-e3d24dcfcbc1 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24517 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24517 · Security Note
• https://t.me/cibsecurity/28286 · Telegram Post