Backup and Staging by WP Time Capsule < 1.22.7 - Reflected Cross-Site Scripting
CVE-2021-25035

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Backup And Staging By WP Time Capsule
Vendor
CVE Published:
24 January 2022

What is CVE-2021-25035?

The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

Affected Version(s)

Backup and Staging by WP Time Capsule 1.22.7

References

https://wpscan.com/vulnerability/f426360e-5ba0-4d6b-bfd4-...
x_refsource_MISC
https://plugins.trac.wordpress.org/changeset/2641264
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jeremie Amsellem
.
CVE-2021-25035 : Backup and Staging by WP Time Capsule < 1.22.7 - Reflected Cross-Site Scripting