Vulnerabilites related to Unknown - User Registration & User Profile – Profile Builder
CVE-2021-24527 (GCVE-0-2021-24527)
Vulnerability from cvelistv5
Published
2021-08-16 10:48
Modified
2024-08-03 19:35
Severity ?
CWE
  • CWE-287 - Improper Authentication
Summary
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example.
References
Impacted products
Vendor Product Version
Unknown User Registration & User Profile – Profile Builder Version: 3.4.9   < 3.4.9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:35:19.893Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/c142e738-bc4b-4058-a03e-1be6fca47207"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "User Registration \u0026 User Profile \u2013 Profile Builder",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.4.9",
              "status": "affected",
              "version": "3.4.9",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Stiofan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The User Registration \u0026 User Profile \u2013 Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-16T10:48:27",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/c142e738-bc4b-4058-a03e-1be6fca47207"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Profile Builder \u003c 3.4.9 - Admin Access via Password Reset",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2021-24527",
          "STATE": "PUBLIC",
          "TITLE": "Profile Builder \u003c 3.4.9 - Admin Access via Password Reset"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "User Registration \u0026 User Profile \u2013 Profile Builder",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "3.4.9",
                            "version_value": "3.4.9"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Stiofan"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The User Registration \u0026 User Profile \u2013 Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example."
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-287 Improper Authentication"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/c142e738-bc4b-4058-a03e-1be6fca47207",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/c142e738-bc4b-4058-a03e-1be6fca47207"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2021-24527",
    "datePublished": "2021-08-16T10:48:27",
    "dateReserved": "2021-01-14T00:00:00",
    "dateUpdated": "2024-08-03T19:35:19.893Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-24448 (GCVE-0-2021-24448)
Vulnerability from cvelistv5
Published
2021-08-02 10:31
Modified
2024-08-03 19:28
Severity ?
CWE
  • CWE-79 - Cross-site Scripting (XSS)
Summary
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
References
Impacted products
Vendor Product Version
Unknown User Registration & User Profile – Profile Builder Version: 3.4.8   < 3.4.8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:28:23.855Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/81e42812-93eb-480d-a2d2-5ba5e02dd0ba"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "User Registration \u0026 User Profile \u2013 Profile Builder",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.4.8",
              "status": "affected",
              "version": "3.4.8",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Akash Rajendra Patil"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The User Registration \u0026 User Profile \u2013 Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its \u0027Modify default Redirect Delay timer\u0027 setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-02T10:31:59",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/81e42812-93eb-480d-a2d2-5ba5e02dd0ba"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Profile Builder \u003c 3.4.8 - Authenticated Stored XSS",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2021-24448",
          "STATE": "PUBLIC",
          "TITLE": "Profile Builder \u003c 3.4.8 - Authenticated Stored XSS"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "User Registration \u0026 User Profile \u2013 Profile Builder",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "3.4.8",
                            "version_value": "3.4.8"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Akash Rajendra Patil"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The User Registration \u0026 User Profile \u2013 Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its \u0027Modify default Redirect Delay timer\u0027 setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/81e42812-93eb-480d-a2d2-5ba5e02dd0ba",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/81e42812-93eb-480d-a2d2-5ba5e02dd0ba"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2021-24448",
    "datePublished": "2021-08-02T10:31:59",
    "dateReserved": "2021-01-14T00:00:00",
    "dateUpdated": "2024-08-03T19:28:23.855Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}