medium6.1
CVE-2021-38315
The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the ~/func…
Impact
The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the ~/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.25.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Smartypantsplugins | Sp Project \& Document Manager | through 4.25 |
Weakness classification
References
- NVD record
- CVE.org record
- https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/functions.php?rev=2566007#L1186
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38315
- https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/functions.php?rev=2566007#L1186
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38315