PT-2021-16247 · WordPress · About Author Box

Francesco Carlucci · Published 2021-11-29 · Updated 2021-11-29 · CVE-2021-24745

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: About Author Box WordPress plugin versions prior to 1.0.2

Description: The issue is related to the About Author Box WordPress plugin, where it does not properly sanitise and escape the Social Profiles field values before outputting them in attributes. This could allow a user with a role as low as contributor to perform Cross-Site Scripting attacks.

Recommendations: For versions prior to 1.0.2, update to version 1.0.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Social Profiles field to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24745

Affected Products

About Author Box

References · 5

• 🔥 https://wpscan.com/vulnerability/a965aeca-d8f9-4070-aa0d-9c9b95493dda · Exploit
• https://osv.dev/vulnerability/CVE-2021-24745 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24745 · Security Note
• https://t.me/cvenotify/23884 · Telegram Post
• https://t.me/cibsecurity/33029 · Telegram Post