WordPress Plugin Vulnerabilities

Check & Log Email < 1.0.4 - Reflected Cross-Site Scripting

Description

The plugin does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting

Proof of Concept

Affects Plugins

Plugin icon
check-email
Fixed in 1.0.4

References

CVE
CVE-2021-24908

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
ZhongFu Su(JrXnm) of Wuhan University
Submitter
ZhongFu Su(JrXnm) of Wuhan University
Submitter website
https://blog.szfszf.top
Submitter twitter
JrXnm
Verified
Yes
WPVDB ID
77f50129-4b1f-4e50-8321-9dd32deba6e1

Timeline

Publicly Published
2021-11-01 (about 4 years ago)
Added
2021-11-01 (about 4 years ago)
Last Updated
2022-09-26 (about 3 years ago)

Other

Published
Title
Published
2021-09-29
Title
WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site Scripting
Published
2016-04-12
Title
Tidio Gallery <= 1.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Published
2024-08-16
Title
Void Contact Form 7 Widget For Elementor Page Builder < 2.4.2 - Authenticated (Author+) Stored Cross-Site Scripting
Published
2023-09-04
Title
Stock Quotes List < 2.9.12 - Contributor+ Stored XSS
Published
2025-02-25
Title
Sina Extension for Elementor < 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text, Countdown Widget, and Login Form Shortcodes