CVE-2021-25105

State: PUBLISHED · Published: 2022-02-07 · Updated: 2024-08-03 · Assigner: WPScan

Description

The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CWE

CWE-79 — CWE-79 Cross-site Scripting (XSS)

Affected

Unknown / Ivory Search – WordPress Search Plugin — v=5.4.1 <5.4.1 [affected]

CVSS

(none)

References

https://wpscan.com/vulnerability/a9ab9e84-7f5e-4e7c-8647-114d9e02e59f x_refsource_MISC

Source

cvelistV5-main/cves/2021/25xxx/CVE-2021-25105.json