nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2021-24294 CVE-2021-24294
MEDIUM
DSGVO All in one for WP < 4.0 - Unauthenticated Stored Cross-Site Scripting (XSS)
Record summary
CVE-2021-24294 has a selected CVSS score of 6.1 (medium); EIP currently links 2 curated repository PoCs.
Description
The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/admin.php?page=dsgvoaiofree-show-log). This could allow unauthenticated attackers to gain unauthorised access by using an XSS payload to create a rogue administrator account, which will be trigged when an administrator will view the logs.
Description source: CVE List
Exploitation context
Available material
- Curated repository PoCs
- 2
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
DSGVO All in one for WPBrowse Michael Leithold / DSGVO All in one for WP | CVE List | 4.0 to < 4.0 | affected |
Proofs of concept
2Curated repository PoCs
GitHubCVE-2021-24294Curated repository PoCby 0xd3vilStars: 127Not analyzed1 file
GitHubCVE-2021-24294Curated repository PoCby yubsyStars: 112Not analyzed1 file
References
2wpscan.comConfirmation
https://wpscan.com/vulnerability/43b8cfb4-f875-432b-8e3b-52653fdee87c