PT-2021-21375 · WordPress · Agca - Absolutely Glamorous Custom Admin

Jörgson · Published 2021-09-23 · Updated 2024-09-16 · CVE-2021-36823

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions AGCA - Absolutely Glamorous Custom Admin (WordPress plugin) versions n/a through 6.8

Description The issue affects the AGCA - Absolutely Glamorous Custom Admin WordPress plugin, allowing Stored XSS due to improper neutralization of input during web page generation. This can occur via unsanitized input fields of the plugin settings. Some payloads could make the frontend and backend inaccessible.

Recommendations For versions n/a through 6.8, update to a version later than 6.8 to resolve the issue. As a temporary workaround, consider restricting access to the plugin settings to minimize the risk of exploitation. Avoid using unsanitized input fields in the plugin settings until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-36823

Affected Products

Agca - Absolutely Glamorous Custom Admin

References · 7

• 🔥 https://youtube.com/watch?v=tnyIIWntOww · Exploit
• https://osv.dev/vulnerability/CVE-2021-36823 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36823 · Security Note
• https://t.me/cibsecurity/29328 · Telegram Post
• https://t.me/cvenotify/94797 · Telegram Post
• https://patchstack.com/database/vulnerability/ag-custom-admin/wordpress-absolutely-glamorous-custom-admin-plugin-6-8-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://t.me/cvenotify/78343 · Telegram Post