CVE Vulnerability

CVE-2021-24545

The WP HTML Author Bio WordPress plugin through 1.2.0 does not sanitise the HTML allowed in the Bio of users, allowing them to use malicious JavaScript code, which will be executed when anyone visit a post in the frontend made by such user. As a result, user with a role as low as author could perform Cross-Site Scripting attacks against users, which could potentially lead to privilege escalation when an admin view the related post/s.

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

5.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://wpscan.com/vulnerability/64267134-9d8c-4e0c-b24f-d18692a5775e Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:wp_html_author_bio_project:wp_html_author_bio:*:*:*:*:*:wordpress:*:*
Information

Published : 2021-10-11 11:15

Updated : 2021-10-15 04:32

NVD link : CVE-2021-24545

Mitre link : CVE-2021-24545

Products Affected
No products.
CWE
CWE-79