CVE-2021-24245

Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS)

EPSS 5.7%CWE-79

Vexday Risk Score

38Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS —EPSS 5.7%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

05 May 2021Published on NVD

19 May 2021Public PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue.

Affected products

Trumani · Stop Spammers

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/162623/WordPress-Stop-Spammers-2021.8-Cross-Site-Scripting.htmlunverified exploitdbwww.exploit-db.com/exploits/49880unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/162623/WordPress-Stop-Spammers-2021.8-Cross-Site-Scripting.html https://wpscan.com/vulnerability/5e7accd6-08dc-4c6e-9d19-73e2d7e97735