PT-2021-16238 · WordPress · Wpdiscuz

Phu Tran · Published 2021-10-11 · Updated 2021-10-15 · CVE-2021-24737

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: wpDiscuz WordPress plugin versions 7.3.0 and earlier

Description: The issue is related to the improper sanitization or escaping of the Follow and Unfollow messages in the wpDiscuz WordPress plugin, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered html capability is disallowed.

Recommendations: For wpDiscuz WordPress plugin versions 7.3.0 and earlier, update to a version later than 7.3.0 to resolve the issue. As a temporary workaround, consider restricting the capability to post Follow and Unfollow messages to trusted users only until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24737

Affected Products

Wpdiscuz

References · 5

• 🔥 https://wpscan.com/vulnerability/f51a350c-c46d-4d52-b787-762283625d0b · Exploit
• https://osv.dev/vulnerability/CVE-2021-24737 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24737 · Security Note
• https://t.me/cibsecurity/30315 · Telegram Post
• https://t.me/cvenotify/22257 · Telegram Post