CVE-2021-24389: FoodBakery < 2.2 - Reflected Cross-Site Scripting (XSS)

Q: What is the severity of CVE-2021-24389?

CVE-2021-24389 is rated as a medium severity vulnerability due to its potential to allow XSS attacks.

Q: How do I fix CVE-2021-24389?

To fix CVE-2021-24389, you should update the WP Foodbakery plugin to version 2.2 or higher.

Q: What type of vulnerability is CVE-2021-24389?

CVE-2021-24389 is an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability.

Q: Who is affected by CVE-2021-24389?

CVE-2021-24389 affects users of the WP Foodbakery WordPress plugin and FoodBakery WordPress theme prior to version 2.2.

Q: Is CVE-2021-24389 exploitable without authentication?

Yes, CVE-2021-24389 can be exploited without authentication, making it particularly dangerous.

Published Jul 6, 2021

Updated

The WP Foodbakery WordPress plugin before 2.2, used in the FoodBakery WordPress theme before 2.2 did not properly sanitize the foodbakeryradius parameter before outputting it back in the response, leading to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability.

Affected Software

1 affected component

Chimpgroup Foodbakery Wordpress<2.2

Event History

Jul 6, 2021

CVE Published

via MITRE·11:03 AM

Data Sourced

via MITRE·11:03 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2021-24389?

CVE-2021-24389 is rated as a medium severity vulnerability due to its potential to allow XSS attacks.

How do I fix CVE-2021-24389?

To fix CVE-2021-24389, you should update the WP Foodbakery plugin to version 2.2 or higher.

What type of vulnerability is CVE-2021-24389?

CVE-2021-24389 is an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability.

Who is affected by CVE-2021-24389?

CVE-2021-24389 affects users of the WP Foodbakery WordPress plugin and FoodBakery WordPress theme prior to version 2.2.

Is CVE-2021-24389 exploitable without authentication?