CVE-2021-39332: Business Manager – WordPress ERP, HR, CRM, and Project Management Plugin <= 1.4.5 Authenticated Stored Cross-Site Scripting
The Business Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization found throughout the plugin which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.4.5. This affects multi-site installations where unfilteredhtml is disabled for administrators, and sites where unfilteredhtml is disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Business Manager – WordPress ERP, HR, CRM, and Project Management Plugin (<= 1.4.5)from your environment.Uninstall the Business Manager WordPress plugin from the WordPress site.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-39332?
CVE-2021-39332 has a medium severity rating due to its potential for allowing stored cross-site scripting attacks.
How do I fix CVE-2021-39332?
To fix CVE-2021-39332, update the Business Manager WordPress plugin to the latest version that addresses the vulnerability.
Who is affected by CVE-2021-39332?
CVE-2021-39332 affects users of the Business Manager WordPress plugin version 1.4.5 and earlier with administrative access.
What type of vulnerability is CVE-2021-39332?
CVE-2021-39332 is classified as a Stored Cross-Site Scripting vulnerability.
Can unprivileged users exploit CVE-2021-39332?
No, CVE-2021-39332 requires administrative user access to exploit the vulnerability.