CVE-2021-25078

The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

2.29% chance of exploitation in the next 30 days, 82th percentile

Nuclei

medium · CWE-79

Published

2022-01-24

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/d4edb5f2-aa1b-4e2d-abb4-76c46def6c6e

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25078.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-25077
• CVE-2021-25079
• CVE-2021-25076
• CVE-2021-25080
• CVE-2021-25075
• CVE-2021-25081