.. / CVE-2021-25016

• XSS
• Nuclei
• Web

Exploit for Chaty < 2.8.2 - Cross-Site Scripting (CVE-2021-25016)

Description:

The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting.

Nuclei Template

View the template here CVE-2021-25016.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-25016.yaml

References: