Description

WordPress Plugin Post Grid Gutenberg Blocks and WordPress Blog-PostX is prone to multiple vulnerabilities, including cross-site scripting and security bypass vulnerabilities. Exploiting these issues may allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, to steal cookie-based authentication credentials, or to perform otherwise restricted actions and subsequently modify/delete/add ultp_options values, or read password-protected or private posts. WordPress Plugin Post Grid Gutenberg Blocks and WordPress Blog-PostX version 2.4.9 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 2.4.10 or latest

References

https://sploitus.com/exploit?id=WPEX-ID:5375BD3E-A30D-4F24-9B17-470B28A8231C

https://sploitus.com/exploit?id=WPEX-ID:5F2FE510-7513-4D33-82D9-3107B3B3F2AE

https://sploitus.com/exploit?id=WPEX-ID:AF14AC23-843D-4F80-BEAF-237618109EDD

https://sploitus.com/exploit?id=WPEX-ID:8D966FF1-9C88-43C7-8F4B-93C88E214677

https://plugins.svn.wordpress.org/ultimate-post/trunk/readme.txt

Related Vulnerabilities

Serendipity Other Vulnerability (CVE-2005-3129)

WordPress Plugin PHP Everywhere Multiple Remote Code Execution Vulnerabilities (2.0.3)

Atlassian Jira Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-39117)

WordPress Plugin Email Subscribers by Icegram Express-Email Marketing, Newsletters, Automation for WordPress & WooCommerce Multiple Vulnerabilities (4.2.2)

Oracle Database Server CVE-2015-0457 Vulnerability (CVE-2015-0457)

Severity

High

Classification

CVE-2021-24652 CVE-2021-24659 CVE-2021-24660 CVE-2021-24661 CWE-79 CWE-264 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update