Skip to content
OpenAdvisories
Unscored Public exploit CVE-2021-24545 EUVD-2021-11457GHSA-xv7x-q4ch-37fx

WP HTML Author Bio <= 1.2.0 - Author+ Stored Cross-Site Scripting

Published Oct 11, 2021 · Updated Aug 3, 2024 · Assigned by WPScan

Category: Web / CMS

Description

The WP HTML Author Bio WordPress plugin through 1.2.0 does not sanitise the HTML allowed in the Bio of users, allowing them to use malicious JavaScript code, which will be executed when anyone visit a post in the frontend made by such user. As a result, user with a role as low as author could perform Cross-Site Scripting attacks against users, which could potentially lead to privilege escalation when an admin view the related post/s.

Affected products

VendorProductAffectedFixed
— WP HTML Author Bio 1.2.0 – ≤ 1.2.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • V35HR4J/CVE-2021-24545 ★ 2 · Oct 5, 2021

    The plugin does not sanitise the HTML allowed in the Bio of users, allowing them to use malicious JavaScript code, which will be executed when anyone visit a post in the frontend made by such user. A…

  • dnr6419/CVE-2021-24545 ★ 0 · Nov 3, 2021

    WordPress Plugin HTML Author Bio description XSS

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References