CVE-2021-24234CWE-79

Ivory Search < 4.6.1 - Reflected Cross Site Scripting (XSS)

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 1.2%

probabilidad de explotación

1.2%top 36% de las CVE

explotación observada

noninguna fuente lo reporta

The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to conduct the attack.

Productos afectados

Unknown · Ivory Search – WordPress Search Plugin

Referencias

https://wpscan.com/vulnerability/ecc620be-8e29-4860-9d32-86b5814a3835 https://www.getastra.com/blog/911/plugin-exploit/reflected-xss-vulnerability-in-ivory-search-wp-plugin/https://www.jinsonvarghese.com/reflected-xss-vulnerability-found-in-ivory-search-plugin/