CVE-2021-47957
MEDIUMWordPress Plugin Cookie Law Bar 1.2.1 Stored XSS via clb_bar_msg
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2021-47957. PoCs published by Mesut Cetin.
AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in the WordPress Cookie Law Bar plugin (v1.2.1) by injecting malicious JavaScript into the 'Bar Message' field, which executes when users browse WordPress pages.
Description
Cookie Law Bar 1.2.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting unsanitized input to the Bar Message field. Attackers can inject script payloads through the plugin settings page that execute in the browsers of all WordPress users viewing the site, enabling cookie theft and sensitive data exfiltration.
Exploits (1)
This exploit demonstrates a stored XSS vulnerability in the WordPress Cookie Law Bar plugin (v1.2.1) by injecting malicious JavaScript into the 'Bar Message' field, which executes when users browse WordPress pages.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N