Jannah < 5.4.4 - Reflected Cross-Site Scripting (XSS)
CVE-2021-24364

6.1MEDIUM

Key Information:

Vendor: Wordpress
Status: Jannah
Vendor: CVE Published:; 21 June 2021

What is CVE-2021-24364?

The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.

Affected Version(s)

Jannah 5.4.4

References

https://wpscan.com/vulnerability/1d53fbe5-a879-42ca-a9d3-...

x_refsource_CONFIRM

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 21, 2021
Vulnerability Reserved
Jan 14, 2021

Credit

Truoc Phan - Techlab Corporation