.. / CVE-2021-24214

• XSS
• Nuclei
• Web

Exploit for WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting (CVE-2021-24214)

Description:

WordPress OpenID Connect Generic Client plugin 3.8.0 and 3.8.1 contains a cross-site scripting vulnerability. It does not sanitize the login error when output back in the login form, thereby not requiring authentication, which can be exploited with the default configuration.

Nuclei Template

View the template here CVE-2021-24214.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-24214.yaml

References: