Vulnerability · Published Jan 16, 2024 · Assigned by WPScan

CVE-2021-24559Qyrr < 0.7 - Authenticated (contributor+) Stored XSS

Medium 5.4

In plain English

A medium-severity security flaw in Qyrr from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 87.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Qyrr WordPress plugin before 0.7 does not escape the data-uri of the QR Code when outputting it in a src attribute, allowing for Cross-Site Scripting attacks. Furthermore, the data_uri_to_meta AJAX action, available to all authenticated users, only had a CSRF check in place, with the nonce available to users with a role as low as Contributor allowing any user with such role (and above) to set a malicious data-uri in arbitrary QR Code posts, leading to a Stored Cross-Site Scripting issue.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Qyrr	0 – before 0.7

References

https://wpscan.com/vulnerability/65a29976-163a-4bbf-a4e8-590ddc4b83f2/ exploit, vdb-entry, technical-description