CVE-2021-24979

🗓️ 27 Dec 2021 10:33:22Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 81 Views🌐 WEB

The Paid Memberships Pro WordPress plugin before 2.6.6 is prone to Reflected Cross-Site Scripting

Reporter	Title	Published	Views	Family All 13
CNNVD	WordPress 插件跨站脚本漏洞	27 Dec 202100:00	–	cnnvd
CNVD	WordPress Paid Memberships Pro plugin cross-site scripting vulnerability	28 Dec 202100:00	–	cnvd
CNVD	WordPress Buttonizer-Smart Floating Action Button plugin cross-site scripting vulnerability	28 Dec 202100:00	–	cnvd
Cvelist	CVE-2021-24979 Paid Memberships Pro < 2.6.6 - Reflected Cross-Site Scripting	27 Dec 202110:33	–	cvelist
EUVD	EUVD-2021-11891	7 Oct 202500:30	–	euvd
Nuclei	Paid Memberships Pro < 2.6.6 - Cross-Site Scripting	6 Jun 202603:01	–	nuclei
NVD	CVE-2021-24979	27 Dec 202111:15	–	nvd
OpenVAS	WordPress Paid Memberships Pro Plugin < 2.6.6 XSS Vulnerability	22 Feb 202200:00	–	openvas
Patchstack	WordPress Paid Memberships Pro plugin <= 2.6.5 - Reflected Cross-Site Scripting (XSS) vulnerability	23 Nov 202100:00	–	patchstack
Prion	Cross site scripting	27 Dec 202111:15	–	prion

NVD

Vulners

Node

strangerstudios paid_memberships_proRange<2.6.6wordpress

[
  {
    "product": "Paid Memberships Pro",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.6.6",
        "status": "affected",
        "version": "2.6.6",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/2632369/paid-memberships-pro/tags/2.6.6/adminpages/discountcodes.php
wpscan	www.wpscan.com/vulnerability/fc011990-4ec1-4553-901d-4ff1f482cb79

Parameter	Position	Path	Description	CWE
s	query param	wp-admin/admin.php?page=pmpro-discountcodes&s=s"+style=animation-name:rotation+onanimationstart=alert(/XSS/)//	Reflected Cross-Site Scripting due to unsanitized output of the s parameter in the admin page	CWE-79

21 Nov 2024 05:54Current

6Medium risk

Vulners AI Score6

CVSS 24.3

CVSS 3.16.1

EPSS0.0269

CWE-79