CVE-2021-24407

MEDIUMNuclei

Jannah < 5.4.5 - Reflected Cross-Site Scripting (XSS)

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24407 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX action, leading to a Reflected Cross-site Scripting (XSS) vulnerability.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Jannah

Browse TieLabs / Jannah
CVE List5.4.5 to < 5.4.5affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Jannah Theme <5.4.5 - Cross-Site ScriptingCVSS 6.1

WordPress Jannah theme before 5.4.5 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX action.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Update the Jannah Theme to version 5.4.5 or later, which includes proper input sanitization to mitigate the XSS vulnerability.

WeaknessesCWE-79
Authorspikpikcu
Template tagscve2021cvewordpressxsswp-themewpscantielabsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:tielabs:jannah:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/fba9f010-1202-4eea-a6f5-78865c084153 https://nvd.nist.gov/vuln/detail/CVE-2021-24407 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2