The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page to the comment section
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/8d015eba-31dc-44cb-a051-4e95df782b75/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/8d015eba-31dc-44cb-a051-4e95df782b75/ | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 06:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/8d015eba-31dc-44cb-a051-4e95df782b75/ - Exploit, Third Party Advisory |
19 Jan 2024, 15:29
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:obg:ark_wysiwyg_comment_editor:*:*:*:*:*:wordpress:*:* | |
| First Time |
Obg
Obg ark Wysiwyg Comment Editor |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| CWE | CWE-74 | |
| References | () https://wpscan.com/vulnerability/8d015eba-31dc-44cb-a051-4e95df782b75/ - Exploit, Third Party Advisory |
16 Jan 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-16 16:15
Updated : 2024-11-21 06:37
NVD link : CVE-2021-4227
Mitre link : CVE-2021-4227
CVE.ORG link : CVE-2021-4227
JSON object : View
Products Affected
obg
- ark_wysiwyg_comment_editor
CWE
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')