CVE-2021-39337: job-portal <= 0.0.1 Authenticated Stored Cross-Site Scripting
First published: Fri Oct 15 2021(Updated: )
The job-portal WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/admin/jobs_function.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 0.0.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Job-portal | <=0.0.1 |
Remedy
Uninstall plugin from WordPress site.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-39337?
CVE-2021-39337 is classified as a high severity vulnerability due to its potential for stored Cross-Site Scripting attacks.
How do I fix CVE-2021-39337?
To fix CVE-2021-39337, update the Job-portal WordPress plugin to a secure version above 0.0.1, ensuring that all input validation and sanitization are properly implemented.
Who is affected by CVE-2021-39337?
CVE-2021-39337 affects users with administrative access to the Job-portal WordPress plugin version 0.0.1 and below.
What is the attack vector for CVE-2021-39337?
The attack vector for CVE-2021-39337 is via the ~/admin/jobs_function.php file where insufficient input validation allows an attacker to inject arbitrary web scripts.
Can CVE-2021-39337 lead to data loss?
Yes, CVE-2021-39337 can lead to data loss or manipulation as the stored Cross-Site Scripting may compromise user sessions and expose sensitive information.
- agent/weakness
- agent/type
- agent/author
- agent/remedy
- agent/title
- agent/description
- agent/severity
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/job-portal project
- canonical/job-portal
- version/job-portal/0.0.1