CVE-2021-24956

MEDIUMNuclei

Blog2Social < 6.8.7 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24956 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Blog2Social: Social Media Auto Post & Scheduler

CVE List6.8.7 to < 6.8.7affected

Nuclei templates

1
ProjectDiscoveryMEDIUMBlog2Social < 6.8.7 - Cross-Site ScriptingCVSS 6.1

The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected website, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Fixed in version 6.8.7

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2021wordpresswp-pluginxssauthenticatedwpscanadenionvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:adenion:blog2social:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/5882ea89-f463-4f0b-a624-150bbaf967c2 https://nvd.nist.gov/vuln/detail/CVE-2021-24956

Source: ProjectDiscovery

References

2