CVE-2021-24229

Katalog CVE

CVSS 9.6 · Critical EPSS 1,8%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada patreon wordpress. Skor CVSS 3.1 9.6 (Critical) menurut NVD.

Deskripsi (NVD)

The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. This AJAX hook is used to update the pledge level required by Patreon subscribers to access a given attachment. This action is accessible for user accounts with the ‘manage_options’ privilege (i.e.., only administrators). Unfortunately, one of the parameters used in this AJAX endpoint is not sanitized before being printed back to the user, so the risk it represents is the same as the previous XSS vulnerability.

Rincian

Terbit di NVD

12 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.6 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 77,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/ exploit · advisory pihak ketiga
• https://wpscan.com/vulnerability/001755c4-add3-4566-a022-ab1f83546c1f advisory pihak ketiga