CVE-2021-24581CWE-352CWE-79

CVE-2021-24581: vulnerability in Blue Admin

Blue Admin <= 21.06.01 - CSRF to Stored Cross-Site Scripting (XSS)

Published · Updated

Follow this CVE+ Monitor Blue Admin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 4.1%
from disclosure to weapon254 days
Published on NVDAug 30
1st PoC+254d
In short

The Blue Admin WordPress plugin allows attackers to inject malicious code through the 'Logo Title' setting without proper protection. An attacker can trick a site administrator into unknowingly saving harmful code that executes in the browsers of all visitors.

Technical detail

The plugin lacks CSRF tokens on its settings save endpoint (CWE-352) and fails to sanitize the 'Logo Title' parameter before outputting it to the page (CWE-79). An unauthenticated attacker can craft a malicious webpage that, when visited by an authenticated admin, submits a forged request to inject and store JavaScript code executed in visitor browsers.

Summary generated and translated by AI from the official description.
The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack.
Affected products
Unknown · Blue Admin
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.