Description (CNA)
The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the ~/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.25.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| SmartyPants / SP Project & Document Manager | affected 4.25 through 4.25 |
CWE
CWE-79
References
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38315
- https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/functions.php?rev=2566007#L1186
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.