Lucene search

WPScanCVE-2021-25077

HistoryFeb 07, 2022 - 4:15 p.m.

CVE-2021-25077

2022-02-0716:15:44

CWE-79

WPScan

web.nvd.nist.gov

cve-2021-25077

nvd

wordpress

woocommerce

plugin

security

vulnerability

xss

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

31.8%

JSON

The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting

Affected configurations

Nvd

Vulners

Node

visserstore_toolkit_for_woocommerceRange<2.3.2wordpress

VendorProductVersionCPE
visserstore_toolkit_for_woocommerce*cpe:2.3:a:visser:store_toolkit_for_woocommerce:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
visser	store_toolkit_for_woocommerce	*	cpe:2.3:a:visser:store_toolkit_for_woocommerce::::::wordpress::*

CNA Affected

[
  {
    "product": "Store Toolkit for WooCommerce",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.3.2",
        "status": "affected",
        "version": "2.3.2",
        "versionType": "custom"
      }
    ]
  }
]

References

plugins.trac.wordpress.org/changeset/2654503

wpscan.com/vulnerability/53868650-aba0-4d07-89d2-a998bb0ee5f6

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

31.8%

JSON

Related for CVE-2021-25077