CVE-2021-36873

MEDIUMNuclei

WordPress iQ Block Country plugin <= 1.2.11 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-36873 has a selected CVSS score of 5.5 (medium); EIP currently links 1 Nuclei template.

Description

Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress iQ Block Country plugin (versions <= 1.2.11). Vulnerable parameter: &blockcountry_blockmessage.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 28, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

iQ Block Country

Browse Webence / iQ Block Country
CVE List1.2.11 to ≤ 1.2.11affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress iQ Block Country <=1.2.11 - Cross-Site ScriptingCVSS 5.4

WordPress iQ Block Country plugin 1.2.11 and prior contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Authenticated attackers can inject malicious JavaScript via stored XSS in the block message field, potentially stealing administrator session cookies or accessing plugin configuration data.

Remediation

Update to the latest version of the WordPress iQ Block Country plugin (>=1.2.12) to mitigate this vulnerability.

WeaknessesCWE-79
Authorstheamanrawat
Template tagscvecve2021wp-pluginiq-block-countrywordpresswpxssauthenticatedwpscanwebencevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:webence:iq_block_country:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/ba93f085-2153-439b-9cda-7c5b09d3ed58 https://wordpress.org/plugins/iq-block-country/ https://patchstack.com/database/vulnerability/iq-block-country-/wordpress-iq-block-country-plugin-1-2-11-authenticated-persistent-cross-site-scripting-xss-vulnerability https://nvd.nist.gov/vuln/detail/CVE-2021-36873 https://wordpress.org/plugins/iq-block-country/#developers

Source: ProjectDiscovery

References

3