CVE-2021-24940

MEDIUMNuclei

Persian Woocommerce <= 5.8.0 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24940 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Persian Woocommerce WordPress plugin through 5.8.0 does not escape the s parameter before outputting it back in an attribute in the admin dashboard, which could lead to a Reflected Cross-Site Scripting issue

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

ووکامرس فارسی

CVE List5.8.0 to ≤ 5.8.0affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Persian Woocommerce <=5.8.0 - Cross-Site ScriptingCVSS 6.1

WordPress Persian Woocommerce plugin through 5.8.0 contains a cross-site scripting vulnerability. The plugin does not escape the s parameter before outputting it back in an attribute in the admin dashboard. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site and possibly steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Fixed in 5.9.8.

WeaknessesCWE-79
Authorsdaffainfo
Template tagscve2021cvewpxssauthenticatedwpscanwordpresswp-pluginwoocommercevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:woocommerce:persian-woocommerce:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/1980c5ca-447d-4875-b542-9212cc7ff77f https://nvd.nist.gov/vuln/detail/CVE-2021-24940 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2