CVE-2021-34660

🗓️ 09 Aug 2021 12:23:26Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 57 Views🌐 WEB

The WP Fusion Lite WordPress plugin is vulnerable to Reflected Cross-Site Scriptin

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2021-34660	9 Aug 202116:36	–	circl
CNNVD	WordPress 跨站脚本漏洞	9 Aug 202100:00	–	cnnvd
Cvelist	CVE-2021-34660 WP Fusion Lite <= 3.37.18 Reflected Cross-Site Scripting	9 Aug 202112:23	–	cvelist
EUVD	EUVD-2021-21310	7 Oct 202500:30	–	euvd
NVD	CVE-2021-34660	9 Aug 202113:15	–	nvd
OSV	CVE-2021-34660	9 Aug 202113:15	–	osv
Patchstack	WordPress WP Fusion Lite plugin <= 3.37.18 - Reflected Cross-Site Scripting (XSS) vulnerability	6 Aug 202100:00	–	patchstack
Prion	Cross site scripting	9 Aug 202113:15	–	prion
Vulnrichment	CVE-2021-34660 WP Fusion Lite <= 3.37.18 Reflected Cross-Site Scripting	9 Aug 202112:23	–	vulnrichment
wpexploit	WP Fusion Lite < 3.37.31 - Reflected Cross-Site Scripting (XSS)	9 Aug 202100:00	–	wpexploit

NVD

Vulners

Node

verygoodplugins wp_fusionRange≤3.37.18litewordpress

[
  {
    "product": "WP Fusion Lite",
    "vendor": "Very Good Plugins",
    "versions": [
      {
        "lessThanOrEqual": "3.37.18",
        "status": "affected",
        "version": "3.37.18",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wordfence	www.wordfence.com/vulnerability-advisories/
plugins	www.plugins.trac.wordpress.org/browser/wp-fusion-lite/trunk/includes/admin/logging/class-log-table-list.php

Parameter	Position	Path	Description	CWE
startdate	query param	/wp-admin/tools.php?page=wpf-settings-logs	Reflected XSS via startdate parameter in WP Fusion Lite logs page output	CWE-79
enddate	query param	/wp-admin/tools.php?page=wpf-settings-logs	Reflected XSS via enddate parameter in WP Fusion Lite logs page output	CWE-79

21 Nov 2024 06:10Current

6Medium risk

Vulners AI Score6

CVSS 24.3

CVSS 3.16.1

EPSS0.0021

SSVC

CWE-79