What is the vulnerability ID for this Asgaros Forums WordPress plugin vulnerability?

The vulnerability ID for this Asgaros Forums WordPress plugin vulnerability is CVE-2021-42365.

What is the severity level of CVE-2021-42365?

The severity level of CVE-2021-42365 is medium, with a severity value of 4.8.

What is the affected software for CVE-2021-42365?

The affected software for CVE-2021-42365 is the Asgaros Forums WordPress plugin up to version 1.15.14.

How can attackers exploit this vulnerability?

Attackers with administrative user access can exploit this vulnerability by injecting arbitrary web scripts.

Vulnerability/
CVE-2021-42365

medium

4.8

CWE

29/11/2021

21/11/2024

CVE-2021-42365: Asgaros Forums <= 1.15.13 Authenticated Stored XSS

Q: How does the vulnerability occur in the Asgaros Forums WordPress plugin?

The vulnerability occurs due to insufficient escaping via the name parameter found in the ~/admin/tables/admin-structure-table.php file of the Asgaros Forums WordPress plugin.

First published: Mon Nov 29 2021(Updated: )

The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the ~/admin/tables/admin-structure-table.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.13. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.

Credit: security@wordfence.com security@wordfence.com

Affected Software	Affected Version	How to fix
Asgaros Forum	<1.15.14

Remedy

https://plugins.trac.wordpress.org/changeset/2635143/asgaros-forum/trunk/admin/tables/admin-structure-table.php

Remedy

Update to version 1.15.14 or newer.

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the vulnerability ID for this Asgaros Forums WordPress plugin vulnerability?
The vulnerability ID for this Asgaros Forums WordPress plugin vulnerability is CVE-2021-42365.
What is the severity level of CVE-2021-42365?
The severity level of CVE-2021-42365 is medium, with a severity value of 4.8.
What is the affected software for CVE-2021-42365?
The affected software for CVE-2021-42365 is the Asgaros Forums WordPress plugin up to version 1.15.14.
How does the vulnerability occur in the Asgaros Forums WordPress plugin?
The vulnerability occurs due to insufficient escaping via the name parameter found in the ~/admin/tables/admin-structure-table.php file of the Asgaros Forums WordPress plugin.
How can attackers exploit this vulnerability?
Attackers with administrative user access can exploit this vulnerability by injecting arbitrary web scripts.

agent/references
agent/type
agent/severity
agent/title
agent/weakness
agent/description
collector/mitre-cve
source/MITRE
agent/remedy
agent/first-publish-date
agent/last-modified-date
agent/author
agent/event
collector/nvd-api
source/NVD
agent/software-canonical-lookup
agent/software-canonical-lookup-request
collector/nvd-index
agent/tags
agent/softwarecombine
agent/source
vendor/asgaros
canonical/asgaros forum

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.