CVE-2021-39340

🗓️ 01 Nov 2021 21:01:17Reported by WordfenceType

The Notification WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization in ~/src/classes/Utils/Settings.php, affecting versions up to 7.2.4

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2021-39340	1 Nov 202123:21	–	circl
CNNVD	WordPress 跨站脚本漏洞	1 Nov 202100:00	–	cnnvd
Cvelist	CVE-2021-39340 Notification – Custom Notifications and Alerts for WordPress <= 7.2.4 Authenticated Stored Cross-Site Scripting	1 Nov 202121:01	–	cvelist
EUVD	EUVD-2021-25701	7 Oct 202500:30	–	euvd
NVD	CVE-2021-39340	1 Nov 202121:15	–	nvd
OSV	CVE-2021-39340	1 Nov 202121:15	–	osv
Patchstack	WordPress Notification plugin <= 7.2.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	25 Oct 202100:00	–	patchstack
Prion	Cross site scripting	1 Nov 202121:15	–	prion
Vulnrichment	CVE-2021-39340 Notification – Custom Notifications and Alerts for WordPress <= 7.2.4 Authenticated Stored Cross-Site Scripting	1 Nov 202121:01	–	vulnrichment
WPVulnDB	Notification < 8.0.0 - Admin+ Stored Cross-Site Scripting	25 Oct 202100:00	–	wpvulndb

NVD

Vulners

Node

bracketspace notificationRange≤7.2.4wordpress

[
  {
    "product": "Notification – Custom Notifications and Alerts for WordPress",
    "vendor": "Notification – Custom Notifications and Alerts for WordPress",
    "versions": [
      {
        "lessThanOrEqual": "7.2.4",
        "status": "affected",
        "version": "7.2.4",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/notification/tags/7.2.4/src/classes/Utils/Settings.php
github	www.github.com/BigTiger2020/word-press/blob/main/Notification.md
wordfence	www.wordfence.com/vulnerability-advisories/

21 Nov 2024 06:19Current

4.8Medium risk

Vulners AI Score4.8

CVSS 22.1

CVSS 3.14.8

EPSS0.0069

SSVC

CWE-79