CVE-2021-24299

Katalog CVE

CVSS 6.1 · Medium EPSS 5,5%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada catzsoft redi restaurant reservation. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to make a restaurant reservation field called 'Comment' does not use proper input validation and can be used to store XSS payloads. The XSS payloads will be executed when the plugin user goes to the 'Upcoming' page, which is an external website https://upcoming.reservationdiary.eu/ loaded in an iframe, and the stored reservation with XSS payload is loaded.

Rincian

Terbit di NVD

17 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

5,5% peluang dieksploitasi; lebih tinggi dari 92,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/162756/WordPress-ReDi-Restaurant-Reservation-21.0307-Cross-Site-Scripting... exploit · advisory pihak ketiga
• https://wpscan.com/vulnerability/fd6ce00b-8c5f-4180-b648-f47b37303670 exploit · advisory pihak ketiga