.. / CVE-2021-39322

• XSS
• Nuclei
• Web

Exploit for WordPress Easy Social Icons Plugin < 3.0.9 - Cross-Site Scripting (CVE-2021-39322)

Description:

The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of $_SERVER['PHP_SELF'] in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected cross-site scripting attack by injecting malicious code in the request path.

Nuclei Template

View the template here CVE-2021-39322.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-39322.yaml

References: