CVE-2021-24934

MEDIUMNuclei

Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24934 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Visual CSS Style Editor WordPress plugin before 7.5.4 does not sanitise and escape the wyp_page_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Visual CSS Style Editor

CVE List7.5.4 to < 7.5.4affected

Nuclei templates

1
ProjectDiscoveryMEDIUMVisual CSS Style Editor < 7.5.4 - Cross-Site ScriptingCVSS 6.1

The plugin does not sanitise and escape the wyp_page_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

Impact

Attackers can inject malicious JavaScript via reflected XSS in the wyp_page_type parameter, potentially stealing administrator session cookies or modifying site appearance.

Remediation

Update to the latest version of plugin.

WeaknessesCWE-79
AuthorsSplint3r7
Template tagscvecve2021wordpresswpwp-pluginyellowpencilxssauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:yellowpencil:visual_css_style_editor:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/0aa5a8d5-e736-4cd3-abfd-8e0a356bb6ef/ https://nvd.nist.gov/vuln/detail/CVE-2021-24934

Source: ProjectDiscovery

References

3