Keeping your WordPress site secure means staying on top of vulnerabilities, especially those found in popular plugins. Today, we’re looking at a Cross-Site Scripting (XSS) vulnerability, identified as CVE-2021-24713, affecting both the Video Lessons Manager and Video Lessons Manager Pro WordPress plugins.<\/p>\n
Cross-Site Scripting (XSS) is a common web security flaw. In simple terms, it allows attackers to inject harmful scripts into web pages viewed by other users. If successful, these scripts can steal sensitive information, deface websites, or even redirect users to malicious sites. In this particular case, the vulnerability lies in how these video lesson plugins handle certain data.<\/p>\n
This vulnerability, tracked as CVE-2021-24713<\/strong>, was publicly disclosed on November 23, 2021. It involves improper handling of user-supplied data within the plugin’s settings. This oversight means that if a high-privilege user (like an administrator) with malicious intent were to save certain unsanitized values, a harmful script could be executed in the browser of anyone viewing those settings. The status of this vulnerability is currently “Analyzed”, meaning it has been thoroughly investigated.<\/p>\n The following WordPress plugins are affected by this Cross-Site Scripting vulnerability:<\/p>\n If you are running any version of these plugins earlier than the ones mentioned, your website could be at risk.<\/p>\n The vulnerability has been thoroughly analyzed, and the developers have released updates to address the issue. This means that a fix is available for users to implement, safeguarding their installations from potential exploitation.<\/p>\n This vulnerability is rated as Medium Severity<\/strong> with a CVSS score of 4.8. While it requires a high-privilege user to introduce the malicious script, once present, it could impact other administrators or users viewing the affected settings. This highlights the importance of keeping all software, especially WordPress plugins, updated and ensuring that only trusted personnel have high-level access to your site’s backend.<\/p>\n To protect your WordPress website from this Cross-Site Scripting vulnerability, it is crucial to update your Video Lessons Manager plugins immediately:<\/p>\n Always back up your website before performing any updates. Regularly checking for and applying updates is a fundamental practice in maintaining a secure WordPress environment. You can often find official security announcements and download the latest versions directly from the plugin developers’ official channels or the WordPress plugin repository.<\/p>\n https:\/\/wpscan.com\/vulnerability\/4a90be69-41eb-43e9-962d-34316497b4df<\/p>\n https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-24713<\/p>\n","protected":false},"excerpt":{"rendered":" Keeping your WordPress site secure means staying on top of vulnerabilities, especially those found in popular plugins. Today, we’re looking at a Cross-Site Scripting (XSS) vulnerability, identified as CVE-2021-24713, affecting both the Video Lessons Manager and Video Lessons Manager Pro WordPress plugins. Cross-Site Scripting (XSS) is a common web security flaw. In simple terms, it […]<\/p>\n","protected":false},"author":17,"featured_media":2545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[817,949,695,736,692],"class_list":["post-3185","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-cross-site-scripting","tag-video-lessons-manager","tag-web-security","tag-wordpress-plugin","tag-xss"],"blocksy_meta":[],"yoast_head":"\nAffected Products<\/h2>\n
\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
References<\/h2>\n