CVE-2021-24488

MEDIUMNuclei

Post Grid < 2.1.8 - Reflected Cross-Site Scripting (XSS)

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-24488 has a selected CVSS score of 6.1 (medium); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Post Grid

CVE List2.1.8 to < 2.1.8affected

Proofs of concept

1

Catalogued exploits

ExploitDBWordPress Plugin Post Grid 2.1.1 - Cross Site Scripting (XSS)ExploitDB exploitby 0xB9Not analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Post Grid <2.1.8 - Cross-Site ScriptingCVSS 6.1

WordPress Post Grid plugin before 2.1.8 contains a reflected cross-site scripting vulnerability. The slider import search feature and tab parameter of thesettings are not properly sanitized before being output back in the pages,

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft or unauthorized actions.

Remediation

Update to the latest version of the WordPress Post Grid plugin (2.1.8 or higher) to mitigate this vulnerability.

WeaknessesCWE-79
Authorscckuailong
Template tagscve2021cveauthenticatedwpscanxsswpwordpresswp-pluginpickpluginsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:pickplugins:post_grid:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/1fc0aace-ba85-4939-9007-d150960add4a https://nvd.nist.gov/vuln/detail/CVE-2021-24488 https://github.com/ARPSyndicate/kenzer-templates https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

2