PT-2021-21385 · WordPress · Wordpress Popular Posts

Re-Alter + 1 · Published 2021-09-23 · Updated 2021-09-29 · CVE-2021-36872

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress Popular Posts plugin versions <= 5.3.3

Description The issue is an Authenticated Persistent Cross-Site Scripting (XSS) vulnerability. It is vulnerable at the &widget-wpp[2][post type] endpoint.

Recommendations For WordPress Popular Posts plugin versions <= 5.3.3, update to a version greater than 5.3.3 to resolve the issue. As a temporary workaround, consider restricting access to the &widget-wpp[2][post type] endpoint until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-36872

Affected Products

Wordpress Popular Posts

References · 5

• https://osv.dev/vulnerability/CVE-2021-36872 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36872 · Security Note
• https://github.com/cabrerahector/wordpress-popular-posts/blob/master/changelog.md · Note
• https://t.me/cibsecurity/29316 · Telegram Post
• https://patchstack.com/database/vulnerability/wordpress-popular-posts/wordpress-popular-posts-plugin-5-3-3-authenticated-persistent-cross-site-scripting-xss-vulnerability · Note