Description (CNA)
The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| cybernetikz / Easy Social Icons | affected 3.0.8 through 3.0.8 |
CWE
CWE-79
References
- https://wpvulndb.com/vulnerabilities/5e0bf0b6-9809-426b-b1d4-1fb653083b58
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39322
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.