CVE-2021-42360: Starter Templates — Elementor, Gutenberg & Beaver Builder Templates <= 2.7.0 Authenticated Block Import to Stored XSS
BrainStormForce · Starter Templates — Elementor, Gutenberg & Beaver Builder Templates
Affected: BrainStormForce Starter Templates — Elementor, Gutenberg & Beaver Builder Templates · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 49% of scored CVEs
DescriptionCVE.org
On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which includes Contributor-level users, to import blocks onto any page using the astra-page-elementor-batch-process AJAX action. An attacker could craft and host a block containing malicious JavaScript on a server they controlled, and then use it to overwrite any post or page by sending an AJAX request with the action set to astra-page-elementor-batch-process and the url parameter pointed to their remotely-hosted malicious block, as well as an id parameter containing the post or page to overwrite. Any post or page that had been built with Elementor, including published pages, could be overwritten by the imported block, and the malicious JavaScript in the imported block would then be executed in the browser of any visitors to that page.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- BrainStormForce · Starter Templates — Elementor, Gutenberg & Beaver Builder Templatesfrom 2.7.0 up to and including 2.7.0
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Weakness
- Cross-site Scripting
- Vendor
- BrainStormForce
- Published
- November 2021
CoverageNo articles yet
No CyberSIXT article names CVE-2021-42360 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.