WordPress Plugin Vulnerabilities

Spideranalyse <= 0.0.1 - Reflected Cross-Site Scripting

Description

The plugin is vulnerable to Reflected Cross-Site Scripting via the date parameter found in the ~/analyse/index.php file which allows attackers to inject arbitrary web scripts.

Affects Plugins

Plugin icon
spideranalyse
No known fix

References

CVE
CVE-2021-38350
URL
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38350

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
p7e4
Verified
No
WPVDB ID
f44a9f38-2d3b-446d-9386-89a06b1ac37a

Timeline

Publicly Published
2021-09-09 (about 2 years ago)
Added
2021-09-10 (about 2 years ago)
Last Updated
2022-04-13 (about 2 years ago)

Other

Published
Title
Published
2024-01-23
Title
illi Link Party! <= 1.0 - Admin+ Stored Cross-Site Scripting
Published
2024-03-28
Title
OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) < 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-09-19
Title
File Manager Pro < 1.8.1 - Admin+ Stored Cross-Site Scripting
Published
2023-04-10
Title
WP Custom Author URL < 1.0.5 - Admin+ Stored XSS
Published
2011-09-27
Title
News < 0.2 - XSS