Vulnerability Description
The Business Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization found throughout the plugin which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.4.5. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bzmngr | Business Manager | <= 1.4.5 |
Related Weaknesses (CWE)
References
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39332Third Party Advisory
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39332Third Party Advisory
FAQ
What is CVE-2021-39332?
CVE-2021-39332 is a vulnerability with a CVSS score of 5.5 (MEDIUM). The Business Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization found throughout the plugin which allowed attackers with admini...
How severe is CVE-2021-39332?
CVE-2021-39332 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-39332?
Check the references section above for vendor advisories and patch information. Affected products include: Bzmngr Business Manager.