CVE-2021-38340

🗓️ 10 Sep 2021 13:33:02Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 36 Views🌐 WEB

The Wordpress Simple Shop plugin is vulnerable to Reflected Cross-Site Scripting via the update_row parameter in add_product.php allowing arbitrary web script injection

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2021-38340	10 Sep 202118:31	–	circl
CNNVD	WordPress 插件跨站脚本漏洞	10 Sep 202100:00	–	cnnvd
Cvelist	CVE-2021-38340 Wordpress Simple Shop <= 1.2 Reflected Cross-Site Scripting	10 Sep 202113:33	–	cvelist
EUVD	EUVD-2021-24793	7 Oct 202500:30	–	euvd
NVD	CVE-2021-38340	10 Sep 202114:15	–	nvd
OSV	CVE-2021-38340	10 Sep 202114:15	–	osv
Patchstack	WordPress WordPress Simple Shop plugin <= 1.2 - Reflected Cross-Site Scripting (XSS) vulnerability	9 Sep 202100:00	–	patchstack
Prion	Cross site scripting	10 Sep 202114:15	–	prion
Vulnrichment	CVE-2021-38340 Wordpress Simple Shop <= 1.2 Reflected Cross-Site Scripting	10 Sep 202113:33	–	vulnrichment
WPVulnDB	WordPress Simple Shop <= 1.2 - Reflected Cross-Site Scripting	9 Sep 202100:00	–	wpvulndb

NVD

Vulners

Node

wordpress_simple_shop_project wordpress_simple_shopRange≤1.2wordpress

[
  {
    "product": "Wordpress Simple Shop",
    "vendor": "Wordpress Simple Shop",
    "versions": [
      {
        "lessThanOrEqual": "1.2",
        "status": "affected",
        "version": "1.2",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wordfence	www.wordfence.com/vulnerability-advisories/
plugins	www.plugins.trac.wordpress.org/browser/webful-simple-grocery-shop/trunk/includes/add_product.php

Parameter	Position	Path	Description	CWE
update_row	query param	wp-content/plugins/simple-shop/includes/add_product.php	Reflected XSS via update_row parameter in Wordpress Simple Shop plugin.	CWE-79

21 Nov 2024 06:16Current

6Medium risk

Vulners AI Score6

CVSS 24.3

CVSS 3.16.1

EPSS0.0021

SSVC

CWE-79