CVE-2021-24316

MEDIUMNuclei

Mediumish <= 1.0.47 - Unauthenticated Reflected Cross-Site Scripting (XSS)

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-24316 has a selected CVSS score of 6.1 (medium); EIP currently links 2 curated repository PoCs and 1 Nuclei template.

Description

The search feature of the Mediumish WordPress theme through 1.0.47 does not properly sanitise it's 's' GET parameter before output it back the page, leading to the Cross-SIte Scripting issue.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
2
Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Mediumish

Browse WowThemes / Mediumish
CVE List1.0.47 to ≤ 1.0.47affected

Proofs of concept

2

Curated repository PoCs

GitHubCVE-2021-24316Curated repository PoCby 0xd3vil127Not analyzed1 file

Python · 523 B

GitHub
PoC details
GitHubCVE-2021-24316Curated repository PoCby yubsy112Not analyzed1 file

Python · 523 B

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Mediumish Theme <=1.0.47 - Cross-Site ScriptingCVSS 6.1

WordPress Mediumish theme 1.0.47 and prior contains an unauthenticated reflected cross-site scripting vulnerability. The 's' GET parameter is not properly sanitized by the search feature before it is output back on the page.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Update to the latest version of the WordPress Mediumish Theme plugin (1.0.47 or higher) to mitigate this vulnerability.

WeaknessesCWE-79
Authors0x_Akoko
Template tagscve2021cvemediumishxsswordpresswpscanintrusivewowthemesvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:wowthemes:mediumish:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/57e27de4-58f5-46aa-9b59-809705733b2e https://m0ze.ru/vulnerability/%5B2021-03-14%5D-%5BWordPress%5D-%5BCWE-79%5D-Mediumish-WordPress-Theme-v1.0.47.txt https://www.wowthemes.net/themes/mediumish-wordpress/ https://nvd.nist.gov/vuln/detail/CVE-2021-24316 https://github.com/ZephrFish/AutoHoneyPoC

Source: ProjectDiscovery

References

4