Keeping your WordPress site secure means staying on top of vulnerabilities, especially those found in popular plugins. Today, we’re looking at a Cross-Site Scripting (XSS) vulnerability, identified as CVE-2021-24713, affecting both the Video Lessons Manager and Video Lessons Manager Pro WordPress plugins.
Cross-Site Scripting (XSS) is a common web security flaw. In simple terms, it allows attackers to inject harmful scripts into web pages viewed by other users. If successful, these scripts can steal sensitive information, deface websites, or even redirect users to malicious sites. In this particular case, the vulnerability lies in how these video lesson plugins handle certain data.
CVE Details
This vulnerability, tracked as CVE-2021-24713, was publicly disclosed on November 23, 2021. It involves improper handling of user-supplied data within the plugin’s settings. This oversight means that if a high-privilege user (like an administrator) with malicious intent were to save certain unsanitized values, a harmful script could be executed in the browser of anyone viewing those settings. The status of this vulnerability is currently “Analyzed”, meaning it has been thoroughly investigated.
Affected Products
The following WordPress plugins are affected by this Cross-Site Scripting vulnerability:
- Video Lessons Manager WordPress plugin: Versions prior to 1.7.2
- Video Lessons Manager Pro WordPress plugin: Versions prior to 3.5.9
If you are running any version of these plugins earlier than the ones mentioned, your website could be at risk.
Current Status
The vulnerability has been thoroughly analyzed, and the developers have released updates to address the issue. This means that a fix is available for users to implement, safeguarding their installations from potential exploitation.
Severity Level
This vulnerability is rated as Medium Severity with a CVSS score of 4.8. While it requires a high-privilege user to introduce the malicious script, once present, it could impact other administrators or users viewing the affected settings. This highlights the importance of keeping all software, especially WordPress plugins, updated and ensuring that only trusted personnel have high-level access to your site’s backend.
Possible Solutions
To protect your WordPress website from this Cross-Site Scripting vulnerability, it is crucial to update your Video Lessons Manager plugins immediately:
- For the Video Lessons Manager WordPress plugin, update to version 1.7.2 or a newer release.
- For the Video Lessons Manager Pro WordPress plugin, update to version 3.5.9 or a newer release.
Always back up your website before performing any updates. Regularly checking for and applying updates is a fundamental practice in maintaining a secure WordPress environment. You can often find official security announcements and download the latest versions directly from the plugin developers’ official channels or the WordPress plugin repository.
References
https://wpscan.com/vulnerability/4a90be69-41eb-43e9-962d-34316497b4df
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24713
