CVE-2021-34640

🗓️ 11 Aug 2021 15:00:01Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 69 Views🌐 WEB

The Securimage-WP-Fixed WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/securimage-wp.php file, allowing attackers to inject arbitrary web scripts

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2021-34640	11 Aug 202118:38	–	circl
CNNVD	WordPress 跨站脚本漏洞	11 Aug 202100:00	–	cnnvd
Cvelist	CVE-2021-34640 Securimage-WP-Fixed <= 3.5.4 Reflected Cross-Site Scripting	11 Aug 202115:00	–	cvelist
EUVD	EUVD-2021-21290	7 Oct 202500:30	–	euvd
Nuclei	WordPress Securimage-WP-Fixed <=3.5.4 - Cross-Site Scripting	6 Jun 202603:01	–	nuclei
NVD	CVE-2021-34640	11 Aug 202115:15	–	nvd
OSV	CVE-2021-34640	11 Aug 202115:15	–	osv
Patchstack	WordPress Securimage-WP-Fixed plugin <= 3.5.4 - Reflected Cross-Site Scripting (XSS) vulnerability	11 Aug 202100:00	–	patchstack
Prion	Cross site scripting	11 Aug 202115:15	–	prion
Vulnrichment	CVE-2021-34640 Securimage-WP-Fixed <= 3.5.4 Reflected Cross-Site Scripting	11 Aug 202115:00	–	vulnrichment

NVD

Vulners

Node

securimage-wp-fixed_project securimage-wp-fixedRange≤3.5.4wordpress

[
  {
    "product": "Securimage-WP-Fixed",
    "vendor": "Securimage-WP-Fixed",
    "versions": [
      {
        "lessThanOrEqual": "3.5.4",
        "status": "affected",
        "version": "3.5.4",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/securimage-wp-fixed/trunk/securimage-wp.php
wordfence	www.wordfence.com/vulnerability-advisories/

Parameter	Position	Path	Description	CWE
page	path	/wp-admin/options-general.php/"> <script>alert(/XSS/)</script>/script%3E?page=securimage-wp-options%2F	Reflected XSS via $_SERVER['PHP_SELF'] in securimage-wp.php	CWE-79

21 Nov 2024 06:10Current

6Medium risk

Vulners AI Score6

CVSS 24.3

CVSS 3.16.1

EPSS0.03864

SSVC

CWE-79