Lucene search

WordfenceCVELIST:CVE-2021-38338

HistorySep 10, 2021 - 1:33 p.m.

CVE-2021-38338 Border Loading Bar <= 1.0.1 Reflected Cross-Site Scripting

2021-09-1013:33:30

CWE-79

Wordfence

www.cve.org

cve-2021-38338

cross-site scripting

border loading bar

wordpress

plugin

vulnerability

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

32.7%

JSON

The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the f and t parameter found in the ~/titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1.

CNA Affected

[
  {
    "product": "Border Loading Bar",
    "vendor": "Border Loading Bar",
    "versions": [
      {
        "lessThanOrEqual": "1.0.1",
        "status": "affected",
        "version": "1.0.1",
        "versionType": "custom"
      }
    ]
  }
]

References

plugins.trac.wordpress.org/browser/border-loading-bar/trunk/titan-framework/iframe-googlefont-preview.php#L39

www.wordfence.com/vulnerability-advisories/#CVE-2021-38338

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

32.7%

JSON

Related for CVELIST:CVE-2021-38338