CVE-2021-24574: Simple Banner < 2.10.4 - Authenticated Stored XSS

Q: Who can exploit this issue?

A high-privilege WordPress user, such as an administrator, can exploit it. Exploitation is possible even when that user does not have the unfiltered_html capability.

Q: What conditions are required for exploitation?

The attacker needs authenticated high-privilege access to the WordPress site and must be able to submit a malicious payload through the affected plugin setting. A victim must then interact with the stored payload for the cross-site scripting to execute.

Q: Is there a fix available?

Yes. The issue affects Simple Banner versions before 2.10.4, and a patch is available.

Published Aug 23, 2021

Updated

The Simple Banner WordPress plugin before 2.10.4 does not sanitise and escape one of its settings, allowing high privilege users such as admin to use Cross-Site Scripting payload even when the unfilteredhtml capability is disallowed.

Affected Software

1 affected component

Simple Banner Project Simple Banner Wordpress<2.10.4

Remediation

Patch Available

https://plugins.trac.wordpress.org/changeset/2571047/

Event History

Aug 23, 2021

CVE Published

via MITRE·11:10 AM

Data Sourced

via MITRE·11:10 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A high-privilege WordPress user, such as an administrator, can exploit it. Exploitation is possible even when that user does not have the unfiltered_html capability.

What conditions are required for exploitation?

The attacker needs authenticated high-privilege access to the WordPress site and must be able to submit a malicious payload through the affected plugin setting. A victim must then interact with the stored payload for the cross-site scripting to execute.

Is there a fix available?

Yes. The issue affects Simple Banner versions before 2.10.4, and a patch is available.

CVE-2021-24574: Simple Banner < 2.10.4 - Authenticated Stored XSS

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

Who can exploit this issue?

What conditions are required for exploitation?

Is there a fix available?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What conditions are required for exploitation?

Is there a fix available?