{"containers": {"cna": {"affected": [{"product": "Project Status", "vendor": "Unknown", "versions": [{"lessThanOrEqual": "1.6", "status": "affected", "version": "1.6", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Shreya Pohekar of Codevigilant Project"}], "descriptions": [{"lang": "en", "value": "The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parameter passed to it before outputting it in an error message when the related post does not exist, leading to a reflected XSS issue"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-08-23T11:10:12", "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://wpscan.com/vulnerability/ca5f2152-fcfd-492d-a552-f9604011beff"}, {"tags": ["x_refsource_MISC"], "url": "https://codevigilant.com/disclosure/2021/wp-plugin-project-status/"}], "source": {"discovery": "UNKNOWN"}, "title": "Project Status <= 1.6 - Reflected Cross-Site Scripting (XSS)", "x_generator": "WPScan CVE Generator", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "contact@wpscan.com", "ID": "CVE-2021-24558", "STATE": "PUBLIC", "TITLE": "Project Status <= 1.6 - Reflected Cross-Site Scripting (XSS)"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Project Status", "version": {"version_data": [{"version_affected": "<=", "version_name": "1.6", "version_value": "1.6"}]}}]}, "vendor_name": "Unknown"}]}}, "credit": [{"lang": "eng", "value": "Shreya Pohekar of Codevigilant Project"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parameter passed to it before outputting it in an error message when the related post does not exist, leading to a reflected XSS issue"}]}, "generator": "WPScan CVE Generator", "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://wpscan.com/vulnerability/ca5f2152-fcfd-492d-a552-f9604011beff", "refsource": "MISC", "url": "https://wpscan.com/vulnerability/ca5f2152-fcfd-492d-a552-f9604011beff"}, {"name": "https://codevigilant.com/disclosure/2021/wp-plugin-project-status/", "refsource": "MISC", "url": "https://codevigilant.com/disclosure/2021/wp-plugin-project-status/"}]}, "source": {"discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "assignerShortName": "WPScan", "cveId": "CVE-2021-24558", "datePublished": "2021-08-23T11:10:12", "dateReserved": "2021-01-14T00:00:00", "dateUpdated": "2021-08-23T11:10:12", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:3.7designs:project_status:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "7C5E4F6B-0A11-47A2-9AD5-41AC7CC322D5", "versionEndIncluding": "1.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parameter passed to it before outputting it in an error message when the related post does not exist, leading to a reflected XSS issue"}, {"lang": "es", "value": "La funci\u00f3n pspin_duplicate_post_save_as_new_post del plugin de WordPress Project Status versiones hasta 1.6, no sanea, comprueba o escapa del par\u00e1metro GET del post que se le pasa antes de mostrarlo en un mensaje de error cuando el post relacionado no se presenta, conllevando a un problema de tipo XSS reflejado."}], "id": "CVE-2021-24558", "lastModified": "2021-08-27T17:24:20.960", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-08-23T12:15:10.080", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://codevigilant.com/disclosure/2021/wp-plugin-project-status/"}, {"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/ca5f2152-fcfd-492d-a552-f9604011beff"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "contact@wpscan.com", "type": "Secondary"}]}

{}