CVE-2021-34643

MEDIUMNuclei

Skaut bazar <= 1.3.2 Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-34643 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Skaut bazar WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/skaut-bazar.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.2.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 5, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Skaut Bazar

Browse Skaut Bazar / Skaut Bazar
CVE List1.3.2 to ≤ 1.3.2affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Skaut Bazar <1.3.3 - Cross-Site ScriptingCVSS 6.1

WordPress Skaut Bazar plugin before 1.3.3 contains a reflected cross-site scripting vulnerability due to the use of $_SERVER['PHP_SELF'] in the ~/skaut-bazar.php file, which allows attackers to inject arbitrary web scripts.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential theft of sensitive information or unauthorized actions.

Remediation

Update to the latest version of WordPress Skaut Bazar plugin (1.3.3) or apply the vendor-provided patch to fix the XSS vulnerability.

WeaknessesCWE-79
AuthorsdhiyaneshDK
Template tagscve2021cvewpscanwordpresswp-pluginauthenticatedskaut-bazar_projectxssvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:skaut-bazar_project:skaut-bazar:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/c1b41276-b8fb-4a5c-bede-84ea62663b7a https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34643 https://plugins.trac.wordpress.org/browser/skaut-bazar/tags/1.3.2/skaut-bazar.php#L657 https://nvd.nist.gov/vuln/detail/CVE-2021-34643 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

3