CVE-2021-24787: Client Invoicing by Sprout Invoices < 19.9.7 - Admin+ Stored Cross-Site Scripting

Q: Who can exploit this issue?

An attacker needs high-privilege access to the affected WordPress site, such as an administrative-level account capable of changing the plugin settings. The issue can still be exploited when WordPress disallows the unfiltered_html capability.

Q: Are installations running version 19.9.7 affected?

The affected versions are those before 19.9.7. Version 19.9.7 is not identified as affected by the provided data.

Q: What is the impact of successful exploitation?

A high-privilege user can store malicious script in plugin settings, causing cross-site scripting when the stored content is rendered. The CVSS vector indicates potential low confidentiality and integrity impact, with no availability impact.

Published Nov 17, 2021

Updated

The Client Invoicing by Sprout Invoices WordPress plugin before 19.9.7 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed

Affected Software

1 affected component

Webventures Client Invoicing By Sprout Invoices Wordpress<19.9.7

Event History

Nov 17, 2021

CVE Published

via MITRE·10:15 AM

Data Sourced

via MITRE·10:15 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs high-privilege access to the affected WordPress site, such as an administrative-level account capable of changing the plugin settings. The issue can still be exploited when WordPress disallows the unfiltered_html capability.

Are installations running version 19.9.7 affected?

The affected versions are those before 19.9.7. Version 19.9.7 is not identified as affected by the provided data.

What is the impact of successful exploitation?

A high-privilege user can store malicious script in plugin settings, causing cross-site scripting when the stored content is rendered. The CVSS vector indicates potential low confidentiality and integrity impact, with no availability impact.

CVE-2021-24787: Client Invoicing by Sprout Invoices < 19.9.7 - Admin+ Stored Cross-Site Scripting

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Are installations running version 19.9.7 affected?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are installations running version 19.9.7 affected?

What is the impact of successful exploitation?