Lucene search

WPScanCVE-2021-24976

HistoryJan 24, 2022 - 8:15 a.m.

CVE-2021-24976

2022-01-2408:15:09

CWE-79

WPScan

web.nvd.nist.gov

wordpress

plugin

smart seo tool

cve-2021-24976

cross-site scripting

nvd

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

31.7%

JSON

The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled, leading to a Reflected Cross-Site Scripting

Affected configurations

Nvd

Vulners

Node

wboltsmart_seo_toolRange<3.0.6wordpress

VendorProductVersionCPE
wboltsmart_seo_tool*cpe:2.3:a:wbolt:smart_seo_tool:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
wbolt	smart_seo_tool	*	cpe:2.3:a:wbolt:smart_seo_tool::::::wordpress::*

CNA Affected

[
  {
    "product": "Smart SEO Tool – SEO优化插件",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "3.0.6",
        "status": "affected",
        "version": "3.0.6",
        "versionType": "custom"
      }
    ]
  }
]

References

plugins.trac.wordpress.org/changeset/2637305

wpscan.com/vulnerability/7d5f58a8-bee4-46be-9c08-d272678338f0

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

31.7%

JSON

Related for CVE-2021-24976