Vulnerabilities > CVE-2021-24988 - Missing Authorization vulnerability in Wprssaggregator WP RSS Aggregator

CVSS 5.4 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

LOW

Integrity impact

LOW

Availability impact

NONE

network

low complexity

wprssaggregator

CWE-862

NVD

Published: 2021-12-27

Updated: 2022-10-24

Summary

The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks, allowing any authenticated users, such as subscriber to call it and set a malicious payload in the addon parameter.

Vulnerable Configurations

Part	Description	Count
Application	Wprssaggregator Wprssaggregator WP RSS Aggregator - Wprssaggregator WP RSS Aggregator 1.0 Wprssaggregator WP RSS Aggregator 1.1 Wprssaggregator WP RSS Aggregator 2.0 Wprssaggregator WP RSS Aggregator 2.1 Wprssaggregator WP RSS Aggregator 2.2 Wprssaggregator WP RSS Aggregator 2.2.1 Wprssaggregator WP RSS Aggregator 2.2.2 Wprssaggregator WP RSS Aggregator 2.2.3 Wprssaggregator WP RSS Aggregator 3.0 Wprssaggregator WP RSS Aggregator 3.1 Wprssaggregator WP RSS Aggregator 3.1.1 Wprssaggregator WP RSS Aggregator 3.2 Wprssaggregator WP RSS Aggregator 3.3 Wprssaggregator WP RSS Aggregator 3.3.1 Wprssaggregator WP RSS Aggregator 3.3.3 Wprssaggregator WP RSS Aggregator 3.4 Wprssaggregator WP RSS Aggregator 3.4.1 Wprssaggregator WP RSS Aggregator 3.4.2 Wprssaggregator WP RSS Aggregator 3.4.3 Wprssaggregator WP RSS Aggregator 3.4.4 Wprssaggregator WP RSS Aggregator 3.4.5 Wprssaggregator WP RSS Aggregator 3.4.6 Wprssaggregator WP RSS Aggregator 3.5 Wprssaggregator WP RSS Aggregator 3.5.1 Wprssaggregator WP RSS Aggregator 3.5.2 Wprssaggregator WP RSS Aggregator 3.6 Wprssaggregator WP RSS Aggregator 3.6.1 Wprssaggregator WP RSS Aggregator 3.7 Wprssaggregator WP RSS Aggregator 3.8 Wprssaggregator WP RSS Aggregator 3.9 Wprssaggregator WP RSS Aggregator 3.9.1 Wprssaggregator WP RSS Aggregator 3.9.2 Wprssaggregator WP RSS Aggregator 3.9.3 Wprssaggregator WP RSS Aggregator 3.9.4 Wprssaggregator WP RSS Aggregator 3.9.5 Wprssaggregator WP RSS Aggregator 3.9.6 Wprssaggregator WP RSS Aggregator 3.9.7 Wprssaggregator WP RSS Aggregator 3.9.8 Wprssaggregator WP RSS Aggregator 3.9.9 Wprssaggregator WP RSS Aggregator 4.0 Wprssaggregator WP RSS Aggregator 4.0.1 Wprssaggregator WP RSS Aggregator 4.0.2 Wprssaggregator WP RSS Aggregator 4.0.3 Wprssaggregator WP RSS Aggregator 4.0.4 Wprssaggregator WP RSS Aggregator 4.0.5 Wprssaggregator WP RSS Aggregator 4.0.6 Wprssaggregator WP RSS Aggregator 4.0.7 Wprssaggregator WP RSS Aggregator 4.0.8 Wprssaggregator WP RSS Aggregator 4.0.9 Wprssaggregator WP RSS Aggregator 4.1 Wprssaggregator WP RSS Aggregator 4.1.1 Wprssaggregator WP RSS Aggregator 4.1.2 Wprssaggregator WP RSS Aggregator 4.1.3 Wprssaggregator WP RSS Aggregator 4.1.4 Wprssaggregator WP RSS Aggregator 4.1.5 Wprssaggregator WP RSS Aggregator 4.1.6 Wprssaggregator WP RSS Aggregator 4.2 Wprssaggregator WP RSS Aggregator 4.2.1 Wprssaggregator WP RSS Aggregator 4.2.2 Wprssaggregator WP RSS Aggregator 4.2.3 Wprssaggregator WP RSS Aggregator 4.3 Wprssaggregator WP RSS Aggregator 4.3.1 Wprssaggregator WP RSS Aggregator 4.4 Wprssaggregator WP RSS Aggregator 4.4.1 Wprssaggregator WP RSS Aggregator 4.4.2 Wprssaggregator WP RSS Aggregator 4.4.3 Wprssaggregator WP RSS Aggregator 4.4.4 Wprssaggregator WP RSS Aggregator 4.5 Wprssaggregator WP RSS Aggregator 4.5.1 Wprssaggregator WP RSS Aggregator 4.5.2 Wprssaggregator WP RSS Aggregator 4.5.3 Wprssaggregator WP RSS Aggregator 4.6 Wprssaggregator WP RSS Aggregator 4.6.1 Wprssaggregator WP RSS Aggregator 4.6.2 Wprssaggregator WP RSS Aggregator 4.6.3 Wprssaggregator WP RSS Aggregator 4.6.4 Wprssaggregator WP RSS Aggregator 4.6.5 Wprssaggregator WP RSS Aggregator 4.6.6 Wprssaggregator WP RSS Aggregator 4.6.7 Wprssaggregator WP RSS Aggregator 4.6.8 Wprssaggregator WP RSS Aggregator 4.6.9 Wprssaggregator WP RSS Aggregator 4.6.10 Wprssaggregator WP RSS Aggregator 4.6.11 Wprssaggregator WP RSS Aggregator 4.6.12 Wprssaggregator WP RSS Aggregator 4.6.13 Wprssaggregator WP RSS Aggregator 4.7 Wprssaggregator WP RSS Aggregator 4.7.1 Wprssaggregator WP RSS Aggregator 4.7.2 Wprssaggregator WP RSS Aggregator 4.7.3 Wprssaggregator WP RSS Aggregator 4.7.4 Wprssaggregator WP RSS Aggregator 4.7.5 Wprssaggregator WP RSS Aggregator 4.7.6 Wprssaggregator WP RSS Aggregator 4.7.7 Wprssaggregator WP RSS Aggregator 4.7.8 Wprssaggregator WP RSS Aggregator 4.8 Wprssaggregator WP RSS Aggregator 4.8.1 Wprssaggregator WP RSS Aggregator 4.8.2 Wprssaggregator WP RSS Aggregator 4.9 Wprssaggregator WP RSS Aggregator 4.9.1 Wprssaggregator WP RSS Aggregator 4.10 Wprssaggregator WP RSS Aggregator 4.11 Wprssaggregator WP RSS Aggregator 4.11.1 Wprssaggregator WP RSS Aggregator 4.11.2 Wprssaggregator WP RSS Aggregator 4.11.3 Wprssaggregator WP RSS Aggregator 4.11.4 Wprssaggregator WP RSS Aggregator 4.12 Wprssaggregator WP RSS Aggregator 4.12.1 Wprssaggregator WP RSS Aggregator 4.12.2 Wprssaggregator WP RSS Aggregator 4.12.3 Wprssaggregator WP RSS Aggregator 4.13 Wprssaggregator WP RSS Aggregator 4.13.1 Wprssaggregator WP RSS Aggregator 4.13.2 Wprssaggregator WP RSS Aggregator 4.14 Wprssaggregator WP RSS Aggregator 4.15 Wprssaggregator WP RSS Aggregator 4.15.1 Wprssaggregator WP RSS Aggregator 4.15.2 Wprssaggregator WP RSS Aggregator 4.16 Wprssaggregator WP RSS Aggregator 4.17 Wprssaggregator WP RSS Aggregator 4.17.1 Wprssaggregator WP RSS Aggregator 4.17.2 Wprssaggregator WP RSS Aggregator 4.17.3 Wprssaggregator WP RSS Aggregator 4.17.4 Wprssaggregator WP RSS Aggregator 4.17.5 Wprssaggregator WP RSS Aggregator 4.17.6 Wprssaggregator WP RSS Aggregator 4.17.7 Wprssaggregator WP RSS Aggregator 4.17.8 Wprssaggregator WP RSS Aggregator 4.17.9 Wprssaggregator WP RSS Aggregator 4.17.10 Wprssaggregator WP RSS Aggregator 4.18 Wprssaggregator WP RSS Aggregator 4.18.1 Wprssaggregator WP RSS Aggregator 4.18.2 Wprssaggregator WP RSS Aggregator 4.19 Wprssaggregator WP RSS Aggregator 4.19.1 Wprssaggregator WP RSS Aggregator 4.19.2	135

Common Weakness Enumeration (CWE)

CWE-862 - Missing Authorization

References

https://wpscan.com/vulnerability/0742483b-6314-451b-a63a-536fd1e14845