Skip to content
CVE PROGRAM SOURCE RECORD6.4 Medium

CVE-2021-4074

WHMCS Bridge <= 6.1 Subscriber+ Stored Cross-Site Scripting

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wordfence

Description

The WHMCS Bridge WordPress plugin is vulnerable to Stored Cross-Site Scripting via the cc_whmcs_bridge_url parameter found in the ~/whmcs-bridge/bridge_cp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.1. Due to missing authorization checks on the cc_whmcs_bridge_add_admin function, low-level authenticated users such as subscribers can exploit this vulnerability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WHMCS Bridge WHMCS Bridge

  • 6.1 to ≤ 6.1affected

References