PT-2021-16004
CVE-2021-24481
·
تاريخ النشر
2021-08-02
·
تاريخ التحديث
2021-08-10
الوصف من
CVSS 3.1
4.8
متوسطةالمقاييسAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Any Hostname WordPress plugin versions 1.0.0 through 1.0.6
Description
The issue arises from the lack of sanitization or escaping of the "Allowed hosts" setting in the plugin, leading to an authenticated stored XSS issue. High privilege users can set XSS payloads in this setting.
Recommendations
For versions 1.0.0 through 1.0.6, as a temporary workaround, consider restricting access to the "Allowed hosts" setting to prevent high privilege users from setting XSS payloads until a patch is available.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾