2 lines
2.9 KiB
JSON
2 lines
2.9 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"affected","product":"ark-commenteditor","vendor":"Unknown","versions":[{"lessThanOrEqual":"2.15.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:obg:ark_wysiwyg_comment_editor:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"0D7DDA5E-7004-48F6-A6E7-4D283878B1DE","versionEndIncluding":"2.15.6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page to the comment section"},{"lang":"es","value":"El complemento de WordPress ark-commenteditor hasta la versión 2.15.6 no sanitiza ni codifica adecuadamente los comentarios cuando está en el editor de código fuente, lo que permite a los atacantes inyectar un iFrame en la página y, por lo tanto, cargar contenido arbitrario desde cualquier página a la sección de comentarios."}],"id":"CVE-2021-4227","lastModified":"2026-06-17T04:19:18.407","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2021-4227","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-05-08T17:18:30.353035Z","version":"2.0.3"}}]},"published":"2024-01-16T16:15:09.270","references":[{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/8d015eba-31dc-44cb-a051-4e95df782b75/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/8d015eba-31dc-44cb-a051-4e95df782b75/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"}],"source":"nvd@nist.gov","type":"Primary"}]}
|