WordPress Plugin Vulnerabilities

eID Easy < 4.7 - Reflected Cross-Site Scripting

Description

The plugin is vulnerable to Reflected Cross-Site Scripting via the error parameter found in the ~/admin.php file which allows attackers to inject arbitrary web scripts.

Affects Plugins

Plugin icon
smart-id
Fixed in 4.7

References

CVE
CVE-2021-34650
URL
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34650

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
p7e4
Verified
Yes
WPVDB ID
03f39571-cce0-49c9-9c27-251a259b4d85

Timeline

Publicly Published
2021-09-17 (about 4 years ago)
Added
2021-09-17 (about 4 years ago)
Last Updated
2022-04-08 (about 4 years ago)

Other

Published
Title
Published
2017-02-14
Title
Easy Table < 1.7 - Admin+ Stored Cross-Site Scripting
Published
2025-03-24
Title
Easy Page Transition <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-03-18
Title
WPB Show Core < 2.7 - Reflected XSS
Published
2022-09-30
Title
CRM Perks Forms < 1.1.1 - Reflected XSS
Published
2025-08-11
Title
WordPress Event Manager, Event Calendar and Booking Plugin < 4.0.25 - Authenticated (Subscriber+) Stored Cross-Site Scripting