PT-2024-11026 · WordPress · Ark-Commenteditor

Rasi Afeef · Published 2024-01-16 · Updated 2024-01-19 · CVE-2021-4227

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ark-commenteditor WordPress plugin versions 2.15.6 and earlier

Description The issue allows attackers to inject an iFrame into the page, enabling them to load arbitrary content from any page into the comment section. This is due to the plugin's failure to properly sanitise or encode comments when in Source editor mode.

Recommendations For ark-commenteditor WordPress plugin versions 2.15.6 and earlier, update to a version later than 2.15.6 to resolve the issue. As a temporary workaround, consider disabling the Source editor mode to minimize the risk of exploitation. Restrict access to the comment section to minimize the risk of arbitrary content loading.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2021-4227

Affected Products

Ark-Commenteditor

References · 4

• 🔥 https://wpscan.com/vulnerability/8d015eba-31dc-44cb-a051-4e95df782b75 · Exploit
• https://osv.dev/vulnerability/CVE-2021-4227 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4227 · Security Note
• https://twitter.com/CVEnew/status/1747293167744090426 · Twitter Post