CVE-2021-24330: Funnel Builder by CartFlows < 1.6.13 - Authenticated Stored XSS via FB Pixel ID and Google Analytics ID
First published: Tue Jun 01 2021(Updated: )
The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin before 1.6.13 did not sanitise its facebook_pixel_id and google_analytics_id settings, allowing high privilege users to set XSS payload in them, which will either be executed on pages generated by the plugin, or the whole website depending on the settings used.
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Krzysztof Kozlowski Konwert | <1.6.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://m0ze.ru/vulnerability/[2021-04-26]-[WordPress]-[CWE-79]-Funnel-Builder-by-CartFlows-WordPress-Plugin-v1.6.12.txt
- https://wpscan.com/vulnerability/b9748066-83b7-4762-9124-de021f687477
- https://m0ze.ru/vulnerability/%5B2021-04-26%5D-%5BWordPress%5D-%5BCWE-79%5D-Funnel-Builder-by-CartFlows-WordPress-Plugin-v1.6.12.txt
Frequently Asked Questions
What is the severity of CVE-2021-24330?
CVE-2021-24330 has a critical severity rating due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2021-24330?
To mitigate CVE-2021-24330, upgrade the Funnel Builder by CartFlows plugin to version 1.6.13 or later.
What types of users are affected by CVE-2021-24330?
CVE-2021-24330 primarily affects high privilege users who can set the facebook_pixel_id and google_analytics_id settings.
What can an attacker do with CVE-2021-24330?
An attacker exploiting CVE-2021-24330 can inject malicious scripts that may execute in the context of users visiting affected pages.
Is CVE-2021-24330 a plugin-specific vulnerability?
Yes, CVE-2021-24330 specifically affects the Funnel Builder by CartFlows WordPress plugin before version 1.6.13.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/title
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- vendor/cartflows
- canonical/krzysztof kozlowski konwert