5.5
CVE-2021-39343
- EPSS 1%
- Veröffentlicht 19.10.2021 15:15:07
- Zuletzt bearbeitet 25.04.2025 19:11:59
- Quelle security@wordfence.com
- CVE-Watchlists
- Unerledigt
LoginMPL-Publisher – Self-publish your book & ebook <= 1.30.2 Authenticated Stored Cross-Site Scripting
MPL-Publisher <= 1.30.2 - Authenticated (Admin+) Stored Cross-Site Scripting
The MPL-Publisher WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/libs/PublisherController.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.30.2. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Mögliche Gegenmaßnahme
MPL-Publisher — Ebook & Audiobook Creator: Update to version 1.30.3, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mpl-publisher ≫ Mpl-publisher SwPlatformwordpress Version <= 1.30.2
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
MPL-Publisher — Ebook & Audiobook Creator
Version
*-1.30.2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1% | 0.584 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.8 | 1.7 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
|
| nvd@nist.gov | 3.5 | 6.8 | 2.9 |
AV:N/AC:M/Au:S/C:N/I:P/A:N
|
| security@wordfence.com | 5.5 | 2.3 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
https://github.com/BigTiger2020/word-press/blob/main/MPL-Publisher.md
https://plugins.trac.wordpress.org/browser/mpl-publisher/trunk/libs/PublisherController.php#L35
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39343
https://www.wordfence.com/threat-intel/vulnerabilities/id/f8d093ae-e0b1-49c2-a492-e01f2e954ddb