CVE-2021-24176

MEDIUMNuclei

JH 404 Logger <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS)

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24176 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.

Description

The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

JH 404 Logger

CVE List1.1 to ≤ 1.1affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress JH 404 Logger <=1.1 - Cross-Site ScriptingCVSS 5.4

WordPress JH 404 Logger plugin through 1.1 contains a cross-site scripting vulnerability. Referer and path of 404 pages are not properly sanitized when they are output in the WordPress dashboard, which can lead to executing arbitrary JavaScript code.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft or unauthorized actions.

Remediation

Update to the latest version of WordPress JH 404 Logger plugin (>=1.2) which addresses the XSS vulnerability.

WeaknessesCWE-79
AuthorsGanofins
Template tagscve2021cvewordpresswp-pluginxsswpscanjh_404_logger_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:jh_404_logger_project:jh_404_logger:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/705bcd6e-6817-4f89-be37-901a767b0585 https://wordpress.org/plugins/jh-404-logger/ https://ganofins.com/blog/my-first-cve-2021-24176/ https://nvd.nist.gov/vuln/detail/CVE-2021-24176 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

3