CVE-2021-24559
Medium
Description
The Qyrr WordPress plugin before 0.7 does not escape the data-uri of the QR Code when outputting it in a src attribute, allowing for Cross-Site Scripting attacks. Furthermore, the data_uri_to_meta AJAX action, available to all authenticated users, only had a CSRF check in place, with the nonce available to users with a role as low as Contributor allowing any user with such role (and above) to set a malicious data-uri in arbitrary QR Code posts, leading to a Stored Cross-Site Scripting issue.
SeverityMedium
CVSS5.4
Exploit probability—
ProductPatrickposner Qyrr
PublishedJan 16, 2024
First seenJan 16, 2024
How to fix
Update
- patrickposner qyrr0.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| patrickposner qyrr | v < 0.7 | 0.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.