CVE-2021-25060CWE-79

Five Star Business Profile and Schema < 2.1.7 - Subscriber+ Page Creation & Settings Update to Stored XSS

published February 21, 2022

CVSS
—
EPSS
1%
Percentile
48.0
In the wild
Unconfirmed
What it is

The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information AJAX action, allowing any authenticated users, such as subscribers, to call them. Furthermore, due to the lack of sanitisation, it also lead to Stored Cross-Site Scripting issues

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00600 · 48.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-02-21T10:45Z
EPSS history
Timeline
  • 21 FEB 10:45Z
    Five Star Business Profile and Schema < 2.1.7 - Subscriber+ Page Creation & Settings Update to Stored XSS
    cvelistv5