Lucene search
WpvulndbWPVDB-ID:90813328-B6E4-44D5-95C3-426749FF0DACHistoryJan 14, 2022 - 12:00 a.m.
WHMCS Bridge < 6.3 - Subscriber+ Stored Cross-Site Scripting
2022-01-1400:00:00
wpscan.com
16
0.001 Low
EPSS
Percentile
19.5%
The plugin is vulnerable to Stored Cross-Site Scripting via the cc_whmcs_bridge_url parameter found in the ~/whmcs-bridge/bridge_cp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.1. Due to missing authorization checks on the cc_whmcs_bridge_add_admin function, low-level authenticated users such as subscribers can exploit this vulnerability.
| CPE | Name | Operator | Version |
|---|---|---|---|
| whmcs-bridge | lt | 6.3 |
Related
patchstack
patchstack
nvd
nvd
CVE-2021-4074
2022-01-18 17:15:09
cnvd
cnvd
WordPress WHMCS Bridge plugin cross-site scripting vulnerability
2022-01-21 00:00:00
cvelist
cvelist
CVE-2021-4074 WHMCS Bridge <= 6.1 Subscriber+ Stored Cross-Site Scripting
2022-01-18 16:52:27
cve
cve
CVE-2021-4074
2022-01-18 17:15:09
prion
prion
Cross site scripting
2022-01-18 17:15:00