Lucene search
Huy NguyenWPVDB-ID:651DC567-943E-4F57-8EC4-6EEE466785F5HistorySep 28, 2021 - 12:00 a.m.
Connections Business Directory < 10.4.3 - Admin+ Stored Cross-Site Scripting
2021-09-2800:00:00
Huy Nguyen
wpscan.com
7
0.001 Low
EPSS
Percentile
24.8%
The plugin does not escape the Address settings when creating an Entry, which could allow high privilege users to perform Cross-Site Scripting when the unfiltered_html capability is disallowed.
PoC
Add an Entry (/wp-admin/admin.php?page=connections_add) and put the following payload in the Address Line fields: inval1d"> The XSS will be triggered when accessing Manage page (/wp-admin/admin.php?page=connections_manage)
| CPE | Name | Operator | Version |
|---|---|---|---|
| connections | lt | 10.4.3 |
Related
patchstack
patchstack
osv
osv
CVE-2021-24794
2021-11-01 09:15:00
cvelist
cvelist
cve
cve
CVE-2021-24794
2021-11-01 09:15:09
wpexploit
wpexploit
Connections Business Directory < 10.4.3 - Admin+ Stored Cross-Site Scripting
2021-09-28 00:00:00
cnvd
cnvd
prion
prion
Cross site scripting
2021-11-01 09:15:00
nvd
nvd
CVE-2021-24794
2021-11-01 09:15:09