CVE-2021-24330: Funnel Builder by CartFlows < 1.6.13 - Authenticated Stored XSS via FB Pixel ID and Google Analytics ID
The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin before 1.6.13 did not sanitise its facebookpixelid and googleanalyticsid settings, allowing high privilege users to set XSS payload in them, which will either be executed on pages generated by the plugin, or the whole website depending on the settings used.
Other sources
The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin before 1.6.13 did not sanitise its facebookpixelid and googleanalyticsid settings, allowing high privilege users to set XSS payload in them, which will either be executed on pages generated by the plugin, or the whole website depending on the settings used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-24330?
CVE-2021-24330 has a critical severity rating due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2021-24330?
To mitigate CVE-2021-24330, upgrade the Funnel Builder by CartFlows plugin to version 1.6.13 or later.
What types of users are affected by CVE-2021-24330?
CVE-2021-24330 primarily affects high privilege users who can set the facebook_pixel_id and google_analytics_id settings.
What can an attacker do with CVE-2021-24330?
An attacker exploiting CVE-2021-24330 can inject malicious scripts that may execute in the context of users visiting affected pages.
Is CVE-2021-24330 a plugin-specific vulnerability?
Yes, CVE-2021-24330 specifically affects the Funnel Builder by CartFlows WordPress plugin before version 1.6.13.