WordPress Plugin Vulnerabilities

Prismatic < 2.8 - Reflected Cross-Site Scripting (XSS)

Description

The plugin does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator

Proof of Concept

Affects Plugins

Plugin icon
prismatic
Fixed in 2.8

References

CVE
CVE-2021-24409

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
apple502j
Submitter
apple502j
Verified
Yes
WPVDB ID
ae3cd3ed-aecd-4d8c-8a2b-2936aaaef0cf

Timeline

Publicly Published
2021-06-21 (about 4 years ago)
Added
2021-06-21 (about 4 years ago)
Last Updated
2021-06-25 (about 4 years ago)

Other

Published
Title
Published
2024-10-14
Title
Add Categories Post Footer <= 2.2.2 - Reflected Cross-Site Scripting
Published
2022-06-06
Title
Limit Login Attempts < 4.0.72 - Admin+ Stored Cross-Site Scripting
Published
2018-01-17
Title
WordPress 3.7-4.9.1 - MediaElement Cross-Site Scripting (XSS)
Published
2023-04-17
Title
Post Shortcode <= 2.0.9 - Contributor+ Stored Cross-Site Scripting
Published
2024-11-08
Title
Bread & Butter < 7.5.880 - Contributor+ Stored XSS