« Volver al listado

CVE-2021-24503

Estado: ModificadaMedia (5.4)—

The Popular Brand Icons – Simple Icons WordPress plugin before 2.7.8 does not sanitise or validate some of its shortcode parameters, such as "color", "size" or "class", allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Thememason — Popular Brand Icons - Simple Icons

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-24503",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Popular Brand Icons – Simple Icons",
          "versions": [
            {
              "status": "affected",
              "version": "2.7.8",
              "lessThan": "2.7.8",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-08-02T11:15:11.097",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/18ab1570-2b4a-48a4-86e6-c1d368563691",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/18ab1570-2b4a-48a4-86e6-c1d368563691",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Popular Brand Icons – Simple Icons WordPress plugin before 2.7.8 does not sanitise or validate some of its shortcode parameters, such as \"color\", \"size\" or \"class\", allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability."
    },
    {
      "lang": "es",
      "value": "El plugin de WordPress Popular Brand Icons - Simple Icons versiones anteriores a 2.7.8, no sanea ni comprueba algunos de los parámetros de sus shortcodes, como \"color\", \"size\" o \"class\", permitiendo a usuarios con un rol tan bajo como el de Contribuyente establecer carga útil de tipo Cross-Site en ellos. Un post hecho por un colaborador todavía tendría que ser aprobado por un administrador para que el ataque de tipo XSS se desencadenará en el frontend, sin embargo, los usuarios con muy privilegiados, como el editor podrían explotar esto sin necesidad de aprobación, e incluso cuando el blog deshabilita la capacidad unfiltered_html"
    }
  ],
  "lastModified": "2026-06-17T03:40:08.727",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:thememason:popular_brand_icons_-_simple_icons:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12DA8CC7-0D7F-4418-A5FE-464F39778AAC",
              "versionEndExcluding": "2.7.8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}