CVE-2021-24522

MEDIUMNuclei

ProfilePress < 3.1.11 - Unauthenticated Cross-Site Scripting (XSS) in tabbed login/register widget

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24522 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/register was not properly escaped and could be used in an XSS attack which could lead to wp-admin access. Further, the plugin in several places assigned $_POST as $_GET which meant that in some cases this could be replicated with just $_GET parameters and no need for $_POST values.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar)

CVE List3.1.11 to < 3.1.11affected

Nuclei templates

1
ProjectDiscoveryMEDIUMProfilePress < 3.1.11 - Cross-Site ScriptingCVSS 5.4

The ProfilePress plugin for WordPress before 3.1.11 is vulnerable to unauthenticated reflected cross-site scripting (XSS) via the tabbed login/register widget due to improper escaping of user input. Attackers can inject arbitrary JavaScript via the tabbed-login-name parameter.

Impact

Attackers can inject malicious JavaScript via reflected XSS in the tabbed login widget, potentially stealing user credentials or session cookies.

Remediation

Update the ProfilePress plugin to version 3.1.11 or later.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2021wordpresswpwp-pluginwp-user-avatarprofilepressxssvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
FOFA: body="wp-content/plugins/wp-user-avatar"
https://wpscan.com/vulnerability/25b51add-197c-4aff-b1a8-b92fb11d8697/ https://plugins.trac.wordpress.org/changeset/2561271/wp-user-avatar https://nvd.nist.gov/vuln/detail/CVE-2021-24522

Source: ProjectDiscovery

References

2