WordPress Plugin Vulnerabilities

WP Maintenance < 6.0.6 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape multiple of its settings, which could allow high privileged users such as admin to perform Cross-Site Scripting attack when the unfiltered_html is disallowed

Affects Plugins

Plugin icon
wp-maintenance
Fixed in 6.0.6

References

CVE
CVE-2021-36828
URL
https://www.hackpertise.com/cve/35-cve-2021-36828/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.4 (low)

Miscellaneous

Original Researcher
Asif Nawaz Minhas
Verified
No
WPVDB ID
b15b7b4d-4f8a-4c38-8169-03701f0ffca5

Timeline

Publicly Published
2022-04-15 (about 4 years ago)
Added
2022-04-16 (about 4 years ago)
Last Updated
2023-04-12 (about 3 years ago)

Other

Published
Title
Published
2024-07-11
Title
PowerPress Podcasting plugin by Blubrry < 11.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via media_url Parameter
Published
2023-10-22
Title
WP Post Columns <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2023-06-15
Title
CHP Ads Block Detector < 3.9.8 - Subscriber+ Stored Cross-Site Scripting
Published
2025-10-31
Title
Schema Scalpel < 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in JSON-LD Schema
Published
2024-04-30
Title
Sailthru Triggermail <= 1.1 - Reflected XSS