CVE-2021-39343

Description

The MPL-Publisher WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/libs/PublisherController.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.30.2. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.

Related CPE's

Could not find any relations

References

https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39343

https://plugins.trac.wordpress.org/browser/mpl-publisher/trunk/libs/PublisherController.php#L35

https://github.com/BigTiger2020/word-press/blob/main/MPL-Publisher.md

CvssV3 impact

Version

3.1

VectorString

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

AttackVector

NETWORK

AttackComplexity

LOW

PrivilegesRequired

HIGH

UserInteraction

NONE

Scope

CHANGED

ConfidentialityImpact

LOW

IntegrityImpact

LOW

AvailabilityImpact

NONE

BaseScore

5.5

BaseSeverity

MEDIUM

CvssV2 impact

Could not find any metrics
Created by Yello
About Severity.io