WordPress Plugin Vulnerabilities

Skaut bazar < 1.3.3 - Reflected Cross-Site Scripting

Description

The plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/skaut-bazar.php file which allows attackers to inject arbitrary web scripts

Proof of Concept

Affects Plugins

Plugin icon
skaut-bazar
Fixed in 1.3.3

References

CVE
CVE-2021-34643
URL
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34643

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
p7e4
Verified
Yes
WPVDB ID
c1b41276-b8fb-4a5c-bede-84ea62663b7a

Timeline

Publicly Published
2021-08-13 (about 4 years ago)
Added
2021-08-13 (about 4 years ago)
Last Updated
2022-04-08 (about 4 years ago)

Other

Published
Title
Published
2025-08-18
Title
Nexter Blocks < 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Published
2014-08-01
Title
Blooog 1.1 - jplayer.swf Cross Site Scripting
Published
2020-10-05
Title
Post Grid < 2.0.73 & Team Showcase < 1.22.16 - Authenticated Stored Cross-Site Scripting (XSS)
Published
2024-09-30
Title
TNC PDF viewer < 3.2.0 - Authenticated (Editor+) Stored Cross-Site Scripting
Published
2023-11-03
Title
Download Top 25 Social Icons <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode