CVE-2021-25016

The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

1.80% chance of exploitation in the next 30 days, 77th percentile

Nuclei

medium · CWE-79

Published

2022-01-03

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/b5035987-6227-4fc6-bc45-1e8016e5c4c0

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25016.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-25015
• CVE-2021-25017
• CVE-2021-25014
• CVE-2021-25018
• CVE-2021-25013
• CVE-2021-25019