Vulnerability · Published Jun 21, 2021 · Assigned by WPScan

CVE-2021-24364Jannah < 5.4.4 - Reflected Cross-Site Scripting (XSS)

Medium 6.1

In plain English

A medium-severity cross-site scripting in Jannah from TieLabs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)2.0%top 19.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Nuclei

Official description

The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.

Affected products (as reported)

Vendor	Product	Versions
TieLabs	Jannah	5.4.4 – before 5.4.4

Weakness: CWE-79

References

https://wpscan.com/vulnerability/1d53fbe5-a879-42ca-a9d3-768a80018382 x_refsource_CONFIRM