CVE-2021-25112

MEDIUMNuclei

WHMCS Bridge < 6.4b - Reflected Cross-Site Scripting (XSS)

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-25112 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

WHMCS Bridge

CVE List6.4b to < 6.4baffected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress WHMCS Bridge <6.4b - Cross-Site ScriptingCVSS 6.1

WordPress WHMCS Bridge plugin before 6.4b contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the error parameter before outputting it back in the admin dashboard.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Update WordPress WHMCS Bridge to version 6.4b or later to mitigate this vulnerability.

WeaknessesCWE-79
AuthorsdhiyaneshDk
Template tagscve2021cvewhmcsxsswpscanwordpresswp-pluginwpauthenticatedi-pluginsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:i-plugins:whmcs_bridge:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/4aae2dd9-8d51-4633-91bc-ddb53ca3471c https://plugins.trac.wordpress.org/changeset/2659751 https://nvd.nist.gov/vuln/detail/CVE-2021-25112 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3