5.4
CVE-2021-24366
- EPSS 1%
- Veröffentlicht 21.06.2021 20:15:08
- Zuletzt bearbeitet 05.05.2025 17:17:00
- Quelle contact@wpscan.com
- CVE-Watchlists
- Unerledigt
LoginAdmin Columns Free < 4.3 & Pro < 5.5.1 - Admin+ Stored XSS in Label
Admin Columns Free < 4.3 and Pro < 5.5.1 Stored Cross-Site Scripting
The Admin Columns WordPress plugin before 4.3 and Admin Columns Pro WordPress plugin before 5.5.1 do not sanitise and escape its Label settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Mögliche Gegenmaßnahme
Admin Columns Pro: Update to version 5.5.1, or a newer patched version
Admin Columns: Update to version 4.3, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Admincolumns ≫ Admin Columns SwEditionfree SwPlatformwordpress Version < 4.3
Admincolumns ≫ Admin Columns SwEditionpro SwPlatformwordpress Version < 5.5.1
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
Admin Columns Pro
Version
[*, 5.5.1)
SystemWordPress Plugin
≫
Produkt
Admin Columns
Version
*-4.2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1% | 0.582 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.4 | 2.3 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
|
| nvd@nist.gov | 3.5 | 6.8 | 2.9 |
AV:N/AC:M/Au:S/C:N/I:P/A:N
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 5.4 | 2.3 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
|
https://github.com/codepress/admin-columns/commit/b45571ed21d574d13687213a5002e0c68e4442c7
https://wpscan.com/vulnerability/05427156-4d5c-4aeb-add8-1c574fda5c28
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-24366
https://www.wordfence.com/threat-intel/vulnerabilities/id/067a5f6c-7ad1-49ac-a581-b50fa89a5f39