Stored Cross-Site Scripting in WP Quick FrontEnd Editor Plugin by WordPress
CVE-2021-4378

6.4MEDIUM

Key Information:

Vendor
Wordpress
Status
WP Quick Frontend Editor – WordPress Plugin
Vendor
CVE Published:
7 June 2023

Summary

The WP Quick FrontEnd Editor plugin for WordPress has a vulnerability that allows authenticated attackers with minimal permissions to execute arbitrary scripts. This occurs due to inadequate sanitization of input and improper output escaping in the plugin. As a result, any injected scripts can run in the context of an affected user's session whenever they visit a page containing malicious code. This presents a significant risk to users and can lead to potential data breaches or site compromises.

Affected Version(s)

WP Quick FrontEnd Editor – WordPress Plugin * <= 5.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://blog.nintechnet.com/multiple-vulnerabilities-in-w...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jerome Bruandet
.