PT-2021-16055 · WordPress · Phonetrack Meu Site Manager

Abisheik M · Published 2021-08-16 · Updated 2021-08-23 · CVE-2021-24534

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PhoneTrack Meu Site Manager WordPress plugin version 0.1

Description The issue arises from the plugin not sanitising or escaping its php id setting before outputting it back in an attribute in the page, leading to a stored Cross-Site Scripting issue.

Recommendations For version 0.1, consider disabling the output of the php id setting in the page attribute until a patch is available to prevent exploitation of the stored Cross-Site Scripting issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24534

Affected Products

Phonetrack Meu Site Manager

References · 5

• 🔥 https://wpscan.com/vulnerability/b968b9a1-67f3-4bef-a3d3-6e8942bb6570 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24534 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24534 · Vendor Advisory
• https://t.me/cvenotify/19393 · Telegram Post
• https://t.me/cibsecurity/27362 · Telegram Post