CVE Vulnerability

CVE-2021-24366

The Admin Columns Free WordPress plugin before 4.3 and Admin Columns Pro WordPress plugin before 5.5.1, rendered input on the posted pages with improper input validation on the value passed into the field 'Label' parameter, by taking this as an advantage an authenticated attacker can supply a crafted arbitrary script and execute it.

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

5.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://wpscan.com/vulnerability/05427156-4d5c-4aeb-add8-1c574fda5c28 Exploit Third Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-24366 Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:admincolumns:admin_columns:*:*:*:*:free:wordpress:*:*
cpe:2.3:a:admincolumns:admin_columns:*:*:*:*:pro:wordpress:*:*
Information

Published : 2021-06-21 08:15

Updated : 2021-06-25 12:34

NVD link : CVE-2021-24366

Mitre link : CVE-2021-24366

Products Affected
No products.
CWE
CWE-79