Medium severity · published Jun 1, 2021
CVE-2021-24330
Funnel Builder by CartFlows < 1.6.13 - Authenticated Stored XSS via FB Pixel ID and Google Analytics ID
4.8
CVSS
0.7%
EPSS
No
On KEV
Description
The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin before 1.6.13 did not sanitise its facebook_pixel_id and google_analytics_id settings, allowing high privilege users to set XSS payload in them, which will either be executed on pages generated by the plugin, or the whole website depending on the settings used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FB
Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress ·
1.6.13 before 1.6.13 · source: vendor
CA
Cartflows · Cartflows
before 1.6.13 · source: NVD
Affected product
FB
Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24330
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24330
m0ze.ru
https://m0ze.ru/vulnerability/%5B2021-04-26%5D-%5BWordPress%5D-%5BCWE-79%5D-Funnel-Builder-by-CartFlows-WordPress-Plugin-v1.6.12.txt
Exploit
https://wpscan.com/vulnerability/b9748066-83b7-4762-9124-de021f687477