Vulnerability · Published Jun 7, 2021 · Assigned by WPScan

CVE-2021-24342JNews < 8.0.6 - Reflected Cross-Site Scripting (XSS)

Medium 6.1

In plain English

A medium-severity cross-site scripting in JNews from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)2.0%top 19.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Nuclei

Official description

The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue.

Affected products (as reported)

Vendor	Product	Versions
Unknown	JNews	8.0.6 – before 8.0.6

Weakness: CWE-79

References

https://wpscan.com/vulnerability/415ca763-fe65-48cb-acd3-b375a400217e x_refsource_CONFIRM