CVE-2021-24516

{"id": "CVE-2021-24516", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2021-10-18T14:15:09.080", "references": [{"url": "https://wpscan.com/vulnerability/88d70e35-4c22-4bc7-b1a5-24068d55257c", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/88d70e35-4c22-4bc7-b1a5-24068d55257c", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "contact@wpscan.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high privilege users such as admin to set XSS payload in it, even when the unfiltered_html is disallowed, leading to an Authenticated Stored Cross-Site Scripting issue."}, {"lang": "es", "value": "El plugin PlanSo Forms de WordPress versiones hasta 2.6.3 no escapa el t\u00edtulo de su Formulario antes de mostrarlo en los atributos, permitiendo a usuarios con privilegios elevados, como los administradores, establecer cargas \u00fatiles de tipo XSS en \u00e9l, incluso cuando no es permitido el uso de unfiltered_html, conllevando a un problema de tipo Cross-Site Scripting issue Almacenado y Autenticado"}], "lastModified": "2024-11-21T05:53:13.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:planso:planso_forms:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "1BCCDC7A-CA17-401E-8050-6E50973A97C8", "versionEndIncluding": "2.6.3"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}