Post Grid < 2.1.16 – Reflected Cross-Site Scripting via keyword | CVE 2021-24986 | Plugin Vulnerabilities

Description

The plugin does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form

Proof of Concept

Append the following payload on a page containing a Post Grid with a search form: ?keyword="+onmouseover=alert(/XSS/)+t="

Then move the mouse over the Search field to trigger the XSS.

Depending on the theme used, other payload can be used, w/o user interaction, for example with the TwentyTwentyTwo one: ?keyword="+style=animation-name:twentytwentyone-close-button-transition+onanimationend=alert(/XSS/)//

Affects Plugins

Fixed in 2.1.16

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

ZhongFu Su(JrXnm) of Wuhan University

Submitter

ZhongFu Su(JrXnm) of Wuhan University

Submitter website

https://blog.szfszf.top

Submitter twitter

Verified

Yes

WPVDB ID

51e57f25-b8b2-44ca-9162-d7328eac64eb

Timeline

Publicly Published

2022-03-15 (about 3 years ago)

Added

2022-03-15 (about 3 years ago)

Last Updated

2022-09-26 (about 3 years ago)

Other

Published

Title

Published

2025-01-06

Title

Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'

Published

2024-03-25

Title

WordPress Importer < 1.0.5 - Reflected Cross-Site Scripting

Published

2021-06-25

Title

Event Espresso Core < 4.10.7.p - Reflected Cross-Site Scripting (XSS)

Published

2025-05-01

Title

KiwiChat NextClient <= 6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter

Published

2024-02-05

Title

Wonder Slider Lite < 14.0 - Reflected Cross-Site Scripting via 'page'