6.1

CVE-2021-25120

Exploit

Easy Social Feed <= 6.2.6 - Reflected Cross-Site Scripting

The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues
Mögliche Gegenmaßnahme
Easy Social Feed – Social Photos Gallery and Post Feed for WordPress: Update to version 6.2.7, or a newer patched version
Easy Social Feed Pro: Update to version 6.2.7, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Easy Social Feed – Social Photos Gallery and Post Feed for WordPress
Version *-6.2.6
SystemWordPress Plugin
≫
Produkt Easy Social Feed Pro
Version *-6.2.6
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Easysocialfeed ≫ Easy Social Feed SwEditionpro SwPlatformwordpress Version < 6.2.7
Easysocialfeed ≫ Easy Social Feed SwEditionfree SwPlatformwordpress Version < 6.3.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 54.08% 0.979
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.