PT-2021-16313 · WordPress · Stylish Cost Calculator

Apple502J · Published 2021-11-29 · Updated 2022-11-09 · CVE-2021-24822

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Stylish Cost Calculator WordPress plugin versions prior to 7.0.4

Description: The issue is related to the lack of authorization and CSRF checks on some AJAX actions in the plugin, which are available to authenticated users. This could allow any authenticated user to perform Stored Cross-Site Scripting attacks against logged-in admins and frontend users due to the lack of sanitization and escaping in some parameters.

Recommendations: For versions prior to 7.0.4, update to version 7.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the AJAX actions until a patch is available. Avoid using the vulnerable parameters in the affected AJAX endpoints until the issue is resolved.

Exploit

Fix

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

CVE-2021-24822

Affected Products

Stylish Cost Calculator

References · 4

• 🔥 https://wpscan.com/vulnerability/db84a782-d4c8-4abf-99ea-ea672a9b806e · Exploit
• https://osv.dev/vulnerability/CVE-2021-24822 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24822 · Security Note
• https://t.me/cvenotify/23877 · Telegram Post