« Volver al listado

CVE-2021-25120

Estado: ModificadaMedia (6.1)—💥 Exploit

The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Easysocialfeed — Easy Social Feed

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-25120",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Easy Social Feed Pro",
          "versions": [
            {
              "status": "affected",
              "version": "6.2.7",
              "lessThan": "6.2.7",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Unknown",
          "product": "Easy Social Feed – Social Photos Gallery – Post Feed – Like Box",
          "versions": [
            {
              "status": "affected",
              "version": "6.2.7",
              "lessThan": "6.2.7",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-04-18T18:15:08.127",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/0ad020b5-0d16-4521-8ea7-39cd206ab9f6",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/0ad020b5-0d16-4521-8ea7-39cd206ab9f6",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues"
    },
    {
      "lang": "es",
      "value": "Los plugins Easy Social Feed Free y Pro de WordPress versiones anteriores a 6.2.7, no sanean algunos de los parámetros usados por medio de acciones AJAX antes de devolverlos a la respuesta, conllevando a problemas de tipo Cross-Site Scripting reflejado"
    }
  ],
  "lastModified": "2026-06-17T03:41:29.777",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:easysocialfeed:easy_social_feed:*:*:*:*:pro:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BEB18F27-076B-4266-8B74-59B7C755769F",
              "versionEndExcluding": "6.2.7"
            },
            {
              "criteria": "cpe:2.3:a:easysocialfeed:easy_social_feed:*:*:*:*:free:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C027F8AE-3FC3-48A4-BA47-838505ED5915",
              "versionEndExcluding": "6.3.4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}