WordPress Plugin Vulnerabilities

MOLIE <= 0.5 - Reflected Cross-Site Scripting

Description

The plugin does not escape the course_id parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

Affects Plugins

Plugin icon
molie-instructure-canvas-linking-tool
No known fix

References

CVE
CVE-2021-25006

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Jeremie Amsellem
Submitter
Jeremie Amsellem
Submitter website
https://lp1.eu
Submitter twitter
lp1eu
Verified
Yes
WPVDB ID
dbe2c6ca-d2f1-40a2-83d5-4623c22d4d61

Timeline

Publicly Published
2021-11-29 (about 4 years ago)
Added
2022-02-15 (about 3 years ago)
Last Updated
2022-04-08 (about 3 years ago)

Other

Published
Title
Published
2024-05-07
Title
Himalayas < 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-05-03
Title
FV Flowplayer Video Player < 7.5.35.7212 - Reflected XSS
Published
2024-11-18
Title
GoQSmile <= 1.0.1 - Reflected Cross-Site Scripting
Published
2025-05-16
Title
X Addons for Elementor < 1.0.17 - Contributor+ Stored XSS
Published
2024-09-04
Title
Team Members Showcase < 4.4.2 - Editor+ Stored XSS