Easy Social Feed < 6.2.7 - Reflected Cross-Site Scripting
CVE-2021-25120

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Easy Social Feed Pro
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box
Vendor
CVE Published:
18 April 2022

What is CVE-2021-25120?

The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues

Affected Version(s)

Easy Social Feed – Social Photos Gallery – Post Feed – Like Box 6.2.7

Easy Social Feed Pro 6.2.7

References

https://wpscan.com/vulnerability/0ad020b5-0d16-4521-8ea7-...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thura Moe Myint
.