Lucene search

[email protected]CVE-2021-33852

HistoryMar 10, 2022 - 5:42 p.m.

CVE-2021-33852

2022-03-1017:42:36

CWE-79

[email protected]

web.nvd.nist.gov

cve-2021-33852

cross-site scripting

xss

code execution

post duplicator plugin

security vulnerability

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

25.0%

JSON

A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser and can use an application as the vehicle for the attack. The XSS payload given in the “Duplicate Title” text box executes whenever the user opens the Settings Page of the Post Duplicator Plugin or the application root page after duplicating any of the existing posts.

Affected configurations

NVD

Node

metaphorcreationspost_duplicatorMatch2.23wordpress

CPENameOperatorVersion
metaphorcreations:post_duplicatormetaphorcreations post duplicatoreq2.23

CPE	Name	Operator	Version
metaphorcreations:post_duplicator	metaphorcreations post duplicator	eq	2.23

CNA Affected

[
  {
    "product": "WordPress Post Duplicator Plugin",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Version 2.23"
      }
    ]
  }
]