CVE-2021-39322

MEDIUMNuclei

Easy Social Icons <= 3.0.8 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-39322 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 5, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Easy Social Icons

Browse cybernetikz / Easy Social Icons
CVE List3.0.8 to ≤ 3.0.8affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Easy Social Icons Plugin < 3.0.9 - Cross-Site ScriptingCVSS 6.1

The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected cross-site scripting attack by injecting malicious code in the request path.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected website, leading to potential data theft, session hijacking, or defacement.

Remediation

Update to the latest version of the WordPress Easy Social Icons Plugin (3.0.9) or apply the vendor-provided patch to mitigate the vulnerability.

WeaknessesCWE-79
AuthorsdhiyaneshDK
Template tagscvecve2021wordpresswp-pluginauthenticatedwpscancybernetikzvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:cybernetikz:easy_social_icons:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/5e0bf0b6-9809-426b-b1d4-1fb653083b58 https://nvd.nist.gov/vuln/detail/CVE-2021-39322 https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39322 https://wpvulndb.com/vulnerabilities/5e0bf0b6-9809-426b-b1d4-1fb653083b58 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

3