The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/59589e74-f901-4f4d-81de-26ad19d1b7fd | Exploit Third Party Advisory |
Configurations
History
No history.
Information
Published : 2021-10-04 12:15
Updated : 2024-02-28 18:48
NVD link : CVE-2021-24676
Mitre link : CVE-2021-24676
CVE.ORG link : CVE-2021-24676
JSON object : View
Products Affected
codesolz
- better_find_and_replace
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')