{"containers": {"cna": {"affected": [{"product": "Target First Plugin", "vendor": "TargetFirst", "versions": [{"status": "affected", "version": "2.0"}]}], "credits": [{"lang": "en", "value": "Vincent MICHEL"}], "descriptions": [{"lang": "en", "value": "The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the 'weeWzKey' parameter that will be save as the 'weeID option and is not sanitized."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-05-24T10:58:04", "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://wpscan.com/vulnerability/4d55d1f5-a7b8-4029-942d-7a13e2498f64"}, {"tags": ["x_refsource_MISC"], "url": "https://www.targetfirst.com/"}], "source": {"discovery": "UNKNOWN"}, "title": "Target First Plugin 2.0 - Unauthenticated Stored XSS via Licence Key", "x_generator": "WPScan CVE Generator", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "contact@wpscan.com", "ID": "CVE-2021-24305", "STATE": "PUBLIC", "TITLE": "Target First Plugin 2.0 - Unauthenticated Stored XSS via Licence Key"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Target First Plugin", "version": {"version_data": [{"version_affected": "=", "version_name": "2.0", "version_value": "2.0"}]}}]}, "vendor_name": "TargetFirst"}]}}, "credit": [{"lang": "eng", "value": "Vincent MICHEL"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the 'weeWzKey' parameter that will be save as the 'weeID option and is not sanitized."}]}, "generator": "WPScan CVE Generator", "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://wpscan.com/vulnerability/4d55d1f5-a7b8-4029-942d-7a13e2498f64", "refsource": "CONFIRM", "url": "https://wpscan.com/vulnerability/4d55d1f5-a7b8-4029-942d-7a13e2498f64"}, {"name": "https://www.targetfirst.com/", "refsource": "MISC", "url": "https://www.targetfirst.com/"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T19:28:23.422Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://wpscan.com/vulnerability/4d55d1f5-a7b8-4029-942d-7a13e2498f64"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.targetfirst.com/"}]}]}, "cveMetadata": {"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "assignerShortName": "WPScan", "cveId": "CVE-2021-24305", "datePublished": "2021-05-24T10:58:04", "dateReserved": "2021-01-14T00:00:00", "dateUpdated": "2024-08-03T19:28:23.422Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:targetfirst:watcheezy:2.0:*:*:*:*:wordpress:*:*", "matchCriteriaId": "074A4273-DCFA-4DBA-8FB8-95B7A7EAAE4C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the 'weeWzKey' parameter that will be save as the 'weeID option and is not sanitized."}, {"lang": "es", "value": "El plugin de WordPress Target First versi\u00f3n v2.0, tambi\u00e9n se conoce anteriormente como Watcheezy, sufre una vulnerabilidad cr\u00edtica de tipo XSS almacenado no autenticado. Un atacante podr\u00eda cambiar el valor de la clave de licencia por medio de un POST en cualquier URL con el par\u00e1metro \"weeWzKey\" que se guardar\u00e1 como la opci\u00f3n 'weeID y no es saneado"}], "id": "CVE-2021-24305", "lastModified": "2021-05-28T20:30:02.010", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-05-24T11:15:08.283", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/4d55d1f5-a7b8-4029-942d-7a13e2498f64"}, {"source": "contact@wpscan.com", "tags": ["Vendor Advisory"], "url": "https://www.targetfirst.com/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "contact@wpscan.com", "type": "Primary"}]}

{}