CVE-2021-34643

The Skaut bazar WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/skaut-bazar.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.2.

Score

CVSS 3.1 6.1 Medium

Status

Modified - security@wordfence.com

Published

2021-08-16

Last modified

2025-05-05

Weaknesses

CWE-79

Affected products

• Skaut-bazar (Skaut-bazar Project)
• Skaut Bazar (Skaut Bazar)

References

• https://plugins.trac.wordpress.org/browser/skaut-bazar/tags/1.3.2/skaut-bazar.php#L657
• https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34643