Ibtana < 1.1.4.9 - Subscriber+ Settings Update to Stored XSS
CVE-2021-25014

3.5LOW

Key Information:

Vendor
Wordpress
Status
Ibtana – WordPress Website Builder
Vendor
CVE Published:
14 February 2022

Summary

The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue.

Affected Version(s)

Ibtana – WordPress Website Builder 1.1.4.9

References

https://wpscan.com/vulnerability/63c58d7f-8e0b-4aa5-b3c8-...
x_refsource_MISC

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Krzysztof Zając
.