CVE-2021-4074 — WHMCS Bridge <= 6.1 Subscriber+ Stored Cross-Site Scripting

Description (CNA)

The WHMCS Bridge WordPress plugin is vulnerable to Stored Cross-Site Scripting via the cc_whmcs_bridge_url parameter found in the ~/whmcs-bridge/bridge_cp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.1. Due to missing authorization checks on the cc_whmcs_bridge_add_admin function, low-level authenticated users such as subscribers can exploit this vulnerability.

Affected (CNA)

Vendor / product	Versions
WHMCS Bridge / WHMCS Bridge	affected 6.1 through 6.1

CWE

CWE-79, CWE-862

References

https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4074
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2653041%40whmcs-bridge&new=2653041%40whmcs-bridge&sfp_email=&sfph_mail=

ADP enrichment

CVE

No English description supplied.

https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4074
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2653041%40whmcs-bridge&new=2653041%40whmcs-bridge&sfp_email=&sfph_mail=

CISA-ADP

No English description supplied.

No references supplied.