WordPress Plugin Vulnerabilities

Securimage-WP-Fixed <= 3.5.4 - Reflected Cross-Site Scripting (XSS)

Description

The plugin is affected by a Reflected Cross-Site Scripting issue due to the use of $_SERVER['PHP_SELF'] in the ~/securimage-wp.php file which allows attackers to inject arbitrary web scripts

Proof of Concept

Affects Plugins

Plugin icon
securimage-wp-fixed
No known fix

References

CVE
CVE-2021-34640
URL
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34640

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
p7e4
Verified
Yes
WPVDB ID
22017067-8675-4884-b976-d7f5a71279d2

Timeline

Publicly Published
2021-08-11 (about 4 years ago)
Added
2021-08-11 (about 4 years ago)
Last Updated
2022-04-12 (about 3 years ago)

Other

Published
Title
Published
2023-01-24
Title
Customer Reviews for WooCommerce < 5.17.0 - Contributor+ Stored XSS
Published
2022-05-31
Title
CURCY < 2.1.18 - Reflected Cross-Site Scripting
Published
2025-12-12
Title
Kingcabs < 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout Parameter
Published
2025-12-31
Title
Series <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-06-05
Title
CodeColorer < 0.10.1 – Admin+ Stored Cross-Site Scripting