Vulnerability · Published Jul 6, 2021 · Assigned by WPScan

CVE-2021-24407Jannah < 5.4.5 - Reflected Cross-Site Scripting (XSS)

Medium 6.1

In plain English

A medium-severity cross-site scripting in Jannah from TieLabs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)2.6%top 14.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Nuclei

Official description

The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX action, leading to a Reflected Cross-site Scripting (XSS) vulnerability.

Affected products (as reported)

Vendor	Product	Versions
TieLabs	Jannah	5.4.5 – before 5.4.5

Weakness: CWE-79

References

https://wpscan.com/vulnerability/fba9f010-1202-4eea-a6f5-78865c084153 x_refsource_CONFIRM