CVEs-PoC/2021/CVE-2021-24522.md

### [CVE-2021-24522](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24522)
![](https://img.shields.io/static/v1?label=Product&message=User%20Registration%2C%20User%20Profile%2C%20Login%20%26%20Membership%20%E2%80%93%20ProfilePress%20(Formerly%20WP%20User%20Avatar)&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=3.1.11%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-site%20Scripting%20(XSS)&color=brightgreen)

### Description

The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/register was not properly escaped and could be used in an XSS attack which could lead to wp-admin access. Further, the plugin in several places assigned $_POST as $_GET which meant that in some cases this could be replicated with just $_GET parameters and no need for $_POST values.

### POC

#### Reference
- https://wpscan.com/vulnerability/25b51add-197c-4aff-b1a8-b92fb11d8697

#### Github
- https://github.com/20142995/nuclei-templates
- https://github.com/ARPSyndicate/cve-scores