CVE-2021-4227

Ark Comment Editor <= 2.15.6 - Iframe Injection via Comment

Medium · published January 16, 2024

CVSS v3.1
5.3
EPSS
1%
Percentile
48.4
In the wild
Unconfirmed
What it is

The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page to the comment section

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00608 · 48.4th percentile
Published
2024-01-16T15:52Z
EPSS history
Timeline
  • 16 JAN 15:52Z
    Ark Comment Editor <= 2.15.6 - Iframe Injection via Comment
    cvelistv5