Easy Accordion < 2.0.22 – Admin+ Stored Cross-Site Scripting | CVE 2021-24576 | Plugin Vulnerabilities

Description

The plugin does not properly sanitize inputs when adding new items to an accordion.

Proof of Concept

When adding new items to an accordion, an injection payload of "<!'/*"/*/'/*/"/*--></Script><Image SrcSet=K */; OnError=confirm`1` //>" for an accordion item's title will result in XSS in the wp-admin page as well as on pages that show the accordion.

Affects Plugins

easy-accordion-free

Fixed in 2.0.22

References

CVE

URL

https://www.hackpertise.com/cve/15-cve-2021-24576/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Asif Nawaz Minhas

Submitter

Asif Nawaz Minhas

Verified

Yes

WPVDB ID

4d0c60d1-db5a-4c4f-9bdb-669975ac7210

Timeline

Publicly Published

2021-09-10 (about 4 years ago)

Added

2021-09-10 (about 4 years ago)

Last Updated

2023-04-12 (about 2 years ago)

Other

Published

Title

Published

2024-06-27

Title

Print My Blog < 3.27.1 - Authenticated (Author+) Stored Cross-Site Scripting

Published

2021-06-30

Title

Newspaper < 11 - Reflected Cross-Site Scripting (XSS)

Published

2025-01-16

Title

Form To JSON <= 1.0 - Reflected Cross-Site Scripting

Published

2022-09-02

Title

Meet My Team <= 2.1 - Contributor+ Stored Cross-Site Scripting

Published

2014-08-01

Title

Seo Link Rotator - pusher.php title Parameter Reflected XSS