CVE-2021-34641 - Vulnerability Details - OpenCVE

The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/src/Actions/Api/TitleDescriptionMeta.php file which allows authenticated attackers to inject arbitrary web scripts, in versions 5.0.0 - 5.0.3.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:S/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Seopress	Seopress

Configuration 1 [-]

cpe:2.3:a:seopress:seopress:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://plugins.trac.wordpress.org/browser/wp-seopress/tags/5.0.4/src/Actions/Api/TitleDescriptionMeta.php#L78
https://www.wordfence.com/blog/2021/08/xss-vulnerability-patched-in-seopress-affects-100000-sites/

History

No history.

MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2021-08-16T18:47:57.481421Z

Updated: 2024-09-16T23:21:08.644Z

Reserved: 2021-06-10T00:00:00

Link: CVE-2021-34641

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-08-16T19:15:14.317

Modified: 2024-11-21T06:10:52.400

Link: CVE-2021-34641

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "SEOPress", "vendor": "SEOPress", "versions": [{"status": "affected", "version": "5.0.0"}, {"status": "affected", "version": "5.0.1"}, {"status": "affected", "version": "5.0.2"}, {"status": "affected", "version": "5.0.3"}]}], "credits": [{"lang": "en", "value": "Chloe Chamberland, Wordfence"}], "datePublic": "2021-08-16T00:00:00", "descriptions": [{"lang": "en", "value": "The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/src/Actions/Api/TitleDescriptionMeta.php file which allows authenticated attackers to inject arbitrary web scripts, in versions 5.0.0 - 5.0.3."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-08-16T18:47:57", "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.wordfence.com/blog/2021/08/xss-vulnerability-patched-in-seopress-affects-100000-sites/"}, {"tags": ["x_refsource_MISC"], "url": "https://plugins.trac.wordpress.org/browser/wp-seopress/tags/5.0.4/src/Actions/Api/TitleDescriptionMeta.php#L78"}], "solutions": [{"lang": "en", "value": "Update plugin to version 5.0.4 or newer."}], "source": {"discovery": "INTERNAL"}, "title": "SEOPress <= 5.0.0 \u2013 5.0.3 Authenticated Stored Cross-Site Scripting", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"AKA": "Wordfence", "ASSIGNER": "security@wordfence.com", "DATE_PUBLIC": "2021-08-16T15:33:00.000Z", "ID": "CVE-2021-34641", "STATE": "PUBLIC", "TITLE": "SEOPress <= 5.0.0 \u2013 5.0.3 Authenticated Stored Cross-Site Scripting"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SEOPress", "version": {"version_data": [{"version_affected": "=", "version_name": "5.0.0", "version_value": "5.0.0"}, {"version_affected": "=", "version_name": "5.0.1", "version_value": "5.0.1"}, {"version_affected": "=", "version_name": "5.0.2", "version_value": "5.0.2"}, {"version_affected": "=", "version_name": "5.0.3", "version_value": "5.0.3"}]}}]}, "vendor_name": "SEOPress"}]}}, "credit": [{"lang": "eng", "value": "Chloe Chamberland, Wordfence"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/src/Actions/Api/TitleDescriptionMeta.php file which allows authenticated attackers to inject arbitrary web scripts, in versions 5.0.0 - 5.0.3."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://www.wordfence.com/blog/2021/08/xss-vulnerability-patched-in-seopress-affects-100000-sites/", "refsource": "MISC", "url": "https://www.wordfence.com/blog/2021/08/xss-vulnerability-patched-in-seopress-affects-100000-sites/"}, {"name": "https://plugins.trac.wordpress.org/browser/wp-seopress/tags/5.0.4/src/Actions/Api/TitleDescriptionMeta.php#L78", "refsource": "MISC", "url": "https://plugins.trac.wordpress.org/browser/wp-seopress/tags/5.0.4/src/Actions/Api/TitleDescriptionMeta.php#L78"}]}, "solution": [{"lang": "en", "value": "Update plugin to version 5.0.4 or newer."}], "source": {"discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T00:19:47.922Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.wordfence.com/blog/2021/08/xss-vulnerability-patched-in-seopress-affects-100000-sites/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://plugins.trac.wordpress.org/browser/wp-seopress/tags/5.0.4/src/Actions/Api/TitleDescriptionMeta.php#L78"}]}]}, "cveMetadata": {"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "assignerShortName": "Wordfence", "cveId": "CVE-2021-34641", "datePublished": "2021-08-16T18:47:57.481421Z", "dateReserved": "2021-06-10T00:00:00", "dateUpdated": "2024-09-16T23:21:08.644Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:seopress:seopress:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "032D1D24-9DBE-4CBD-A169-83DD6D513235", "versionEndExcluding": "5.0.4", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/src/Actions/Api/TitleDescriptionMeta.php file which allows authenticated attackers to inject arbitrary web scripts, in versions 5.0.0 - 5.0.3."}, {"lang": "es", "value": "El plugin SEOPress de WordPress, es vulnerable a un ataque de tipo Cross-Site-Scripting Almacenado por medio de la funci\u00f3n processPut encontrada en el archivo ~/src/Actions/Api/TitleDescriptionMeta.php que permite a atacantes autenticados inyectar scripts web arbitrario, en las versiones 5.0.0 - 5.0.3."}], "id": "CVE-2021-34641", "lastModified": "2024-11-21T06:10:52.400", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-08-16T19:15:14.317", "references": [{"source": "security@wordfence.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://plugins.trac.wordpress.org/browser/wp-seopress/tags/5.0.4/src/Actions/Api/TitleDescriptionMeta.php#L78"}, {"source": "security@wordfence.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.wordfence.com/blog/2021/08/xss-vulnerability-patched-in-seopress-affects-100000-sites/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://plugins.trac.wordpress.org/browser/wp-seopress/tags/5.0.4/src/Actions/Api/TitleDescriptionMeta.php#L78"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.wordfence.com/blog/2021/08/xss-vulnerability-patched-in-seopress-affects-100000-sites/"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}