5.4

CVE-2021-33852

Exploit

Post Duplicator <= 2.23 - Cross-Site Scripting

A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Duplicate Title" text box executes whenever the user opens the Settings Page of the Post Duplicator Plugin or the application root page after duplicating any of the existing posts.
Mögliche Gegenmaßnahme
Post Duplicator: Update to version 2.24, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Metaphorcreations ≫ Post Duplicator Version2.23 SwPlatformwordpress
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Post Duplicator
Version [*, 2.24)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.63% 0.452
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://cybersecurityworks.com/zerodays/cve-2021-33852-stored-cross-site-scripting-in-wordpress-post-duplicator-plugin-2-23.html
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/c763a8d8-c31a-4c9f-8f0e-814cda91b860
Third Party Advisory