CVE-2021-38358: XSS
First published: Fri Sep 10 2021(Updated: )
The MoolaMojo WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the ~/views/button-generator.html.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.4.1.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Kibokolabs Moolamojo | <=0.7.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-38358?
CVE-2021-38358 is a vulnerability in the MoolaMojo WordPress plugin that allows for Reflected Cross-Site Scripting via the classes parameter.
How severe is CVE-2021-38358?
CVE-2021-38358 has a severity score of 6.1, which is considered medium.
Which versions of MoolaMojo WordPress plugin are affected by CVE-2021-38358?
Versions up to and including 0.7.4.1 of the MoolaMojo WordPress plugin are affected by CVE-2021-38358.
How can an attacker exploit CVE-2021-38358?
An attacker can exploit CVE-2021-38358 by injecting arbitrary web scripts through the classes parameter in the ~/views/button-generator.html.php file.
Are there any references for CVE-2021-38358?
Yes, you can find more information about CVE-2021-38358 at the following references: [Reference 1](https://plugins.trac.wordpress.org/browser/moolamojo/trunk/views/button-generator.html.php#L16) and [Reference 2](https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38358).
- collector/nvd-index
- vendor/kibokolabs
- canonical/kibokolabs moolamojo
- version/kibokolabs moolamojo/0.7.4.1