PT-2021-16129 · WordPress · Post Views Counter

Tung Duong Dinh · Published 2021-09-20 · Updated 2021-10-01 · CVE-2021-24613

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Post Views Counter WordPress plugin versions prior to 1.3.5

Description The issue allows high privilege users to perform Cross-Site Scripting attacks in the frontend, even when the unfiltered html capability is disallowed, due to the plugin not sanitising or escaping its Post Views Label settings.

Recommendations For versions prior to 1.3.5, update to version 1.3.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the Post Views Label settings to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24613

Affected Products

Post Views Counter

References · 5

• 🔥 https://wpscan.com/vulnerability/0b8c5947-bc73-448e-8f10-a4f4456e4000 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24613 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24613 · Vendor Advisory
• https://t.me/cvenotify/21148 · Telegram Post
• https://t.me/cibsecurity/29097 · Telegram Post