CVE-2021-24955 — MEDIUM (6.1)

Q: How severe is CVE-2021-24955?

CVE-2021-24955 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2021-24955?

Check the references section above for vendor advisories and patch information. Affected products include: Profilepress User Registration\, Login Form\, User Profile \& Membership.

Vulnerability Description

The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue

CVSS Score

6.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Profilepress	User Registration\, Login Form\, User Profile \& Membership	< 3.2.3

Related Weaknesses (CWE)

CWE-79

References

https://plugins.trac.wordpress.org/changeset/2626573/PatchThird Party Advisory
https://wpscan.com/vulnerability/e8005d4d-41c3-451d-b85a-2626decaa080ExploitThird Party Advisory
https://plugins.trac.wordpress.org/changeset/2626573/PatchThird Party Advisory
https://wpscan.com/vulnerability/e8005d4d-41c3-451d-b85a-2626decaa080ExploitThird Party Advisory

FAQ

What is CVE-2021-24955?

CVE-2021-24955 is a vulnerability with a CVSS score of 6.1 (MEDIUM). The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back ...

How severe is CVE-2021-24955?

CVE-2021-24955 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-24955?

Check the references section above for vendor advisories and patch information. Affected products include: Profilepress User Registration\, Login Form\, User Profile \& Membership.