CVE-2021-24681

MEDIUMNuclei

Duplicate Page <= 4.4.2 - Admin+ Stored Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24681 has a selected CVSS score of 4.8 (medium); EIP currently links 1 Nuclei template.

Description

The Duplicate Page WordPress plugin through 4.4.2 does not sanitise or escape the Duplicate Post Suffix settings before outputting it, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Duplicate Page

CVE List4.4.2 to ≤ 4.4.2affected

Nuclei templates

1
ProjectDiscoveryMEDIUMDuplicate Page WordPress - Stored Cross-Site ScriptingCVSS 4.8

Duplicate Page WordPress plugin <= 4.4.2 contains a stored cross-site scripting caused by unsanitized Duplicate Post Suffix settings in output, letting high privilege users execute malicious scripts, exploit requires high privilege user role.

Impact

Attackers can execute malicious scripts in the context of the site, potentially leading to session hijacking or defacement.

Remediation

Update to the latest version of the plugin where the issue is fixed.

WeaknessesCWE-79
Authorstheamanrawat
Template tagswpscancvecve2021wordpresswpwp-pluginduplicate-pagexssvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:duplicatepro:duplicate_page:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/9ebdd1df-1d6f-4399-8b0f-77a79f841464 https://wordpress.org/plugins/duplicate-page https://nvd.nist.gov/vuln/detail/CVE-2021-24681

Source: ProjectDiscovery

References

2