Description
The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default configuration.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| daggerhart | OpenID Connect Generic Client | 3.8.0 – < 3.8.0*, 3.8.2 – < 3.8.2 | 3.8.0* |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting http/cves/2021/CVE-2021-24214.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.