CVE-2021-25076

WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting

The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting

Affected

WP User Frontend – Membership, Profile, Registration & Post Submission Plugin for WordPress

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

17.12% chance of exploitation in the next 30 days, 97th percentile

Published

2022-01-24

Updated

2024-08-03

Proof-of-concept exploits (6)

• http://packetstormsecurity.com/files/166071/WordPress-WP-User-Frontend-3.5.25-SQL-Injecti…
• https://wpscan.com/vulnerability/6d3eeba6-5560-4380-a6e9-f008a9112ac6
• 0xAbbarhSF/CVE-2021-250763★ · 2022-06-04
• 0xStarFord/CVE-2021-250763★ · 2022-06-04
• ar2o3/CVE-2021-250763★ · 2022-06-04
• abbarhissarh/CVE-2021-250763★ · 2022-06-04

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50772

Security advisories

• https://plugins.trac.wordpress.org/changeset/2648715

References

• CVE Record
• NVD entry

Related

• CVE-2020-2551
• CVE-2020-29607
• CVE-2022-24124
• CVE-2022-26133
• CVE-2022-30190