Vulnerability · Published Jan 16, 2024 · Assigned by WPScan
CVE-2021-24433Simple Sort&Search <= 0.0.3 - Ccontributor+ Stored XSS
Medium 5.4
In plain English
A medium-severity security flaw in simple sort&search from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.4%top 62.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The simple sort&search WordPress plugin through 0.0.3 does not make sure that the indexurl parameter of the shortcodes "category_sims", "order_sims", "orderby_sims", "period_sims", and "tag_sims" use allowed URL protocols, which can lead to stored cross-site scripting by users with a role as low as Contributor
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | simple sort&search | 0 – through 0.0.3 |
References
- https://wpscan.com/vulnerability/2ce8c786-ba82-427c-b5e7-e3b300a24c5f/ exploit, vdb-entry, technical-description