medium6.1
CVE-2021-38359
The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the message parameter f…
Impact
The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the message parameter found in the ~/admin/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.1.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Invitebox | Invitebox | through 1.4.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://plugins.trac.wordpress.org/browser/refer-a-friend-widget-for-wp/tags/1.4.1/admin/admin.php#L75
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38359
- https://plugins.trac.wordpress.org/browser/refer-a-friend-widget-for-wp/tags/1.4.1/admin/admin.php#L75
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38359