CVEs-PoC/2021/CVE-2021-25044.md

### [CVE-2021-25044](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25044)
![](https://img.shields.io/static/v1?label=Product&message=Cryptocurrency%20Pricing%20list%20and%20Ticker&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=1.5%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen)

### Description

The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpw_setpage parameter before outputting it back in pages where its shortcode is embed, leading to a Reflected Cross-Site Scripting issue

### POC

#### Reference
- https://wpscan.com/vulnerability/dc1507c1-8894-4ab6-b25f-c5e26a425b03

#### Github
- https://github.com/20142995/nuclei-templates