CVE-2021-24342

MEDIUMNuclei

JNews < 8.0.6 - Reflected Cross-Site Scripting (XSS)

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24342 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

JNews

CVE List8.0.6 to < 8.0.6affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress JNews Theme <8.0.6 - Cross-Site ScriptingCVSS 6.1

WordPress JNews theme before 8.0.6 contains a reflected cross-site scripting vulnerability. It does not sanitize the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*).

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.

Remediation

Update to the latest version of the WordPress JNews Theme (>=8.0.6) to mitigate the XSS vulnerability.

WeaknessesCWE-79
Authorspikpikcu
Template tagscve2021cvewordpressxsswp-pluginwpscanjnewsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:jnews:jnews:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/415ca763-fe65-48cb-acd3-b375a400217e https://nvd.nist.gov/vuln/detail/CVE-2021-24342 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2