CVE-2021-24229 Patreon WordPress < 1.7.2 - Reflected XSS on patreon_save_attachment_patreon_level AJAX action

Q: What is CVE-2021-24229?

CVE-2021-24229 is a critical cross-site scripting vulnerability in Unknown Patreon WordPress, published on 12 Apr 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Q: Is CVE-2021-24229 being exploited?

There is no known exploitation of CVE-2021-24229 in the wild and no public exploit code.

Q: How do I fix CVE-2021-24229?

No fix has been published for CVE-2021-24229 yet. Limit exposure of the affected software until one is available.

Critical 9.6 Published 12 Apr 2021 Updated 3 Aug 2024

Reflected XSS in Patreon WordPress plugin allows administrators to execute arbitrary scripts via unsanitized AJAX parameters.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-24229?

CVE-2021-24229 is a critical cross-site scripting vulnerability in Unknown Patreon WordPress, published on 12 Apr 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. This AJAX hook is used to update the pledge level required by Patreon subscribers to access a given attachment. This action is accessible for user accounts with the ‘manage_options’ privilege (i.e.., only administrators). Unfortunately, one of the parameters used in this AJAX endpoint is not sanitized before being printed back to the user, so the risk it represents is the same as the previous XSS vulnerability.

Weakness: CWE-79

Which versions are affected by CVE-2021-24229?

It affects 1 product.

Products include Patreon Patreon Wordpress.

How do I fix CVE-2021-24229?

No fix has been published for CVE-2021-24229 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-24229 being exploited?

There is no known exploitation of CVE-2021-24229 in the wild and no public exploit code.

Sources

Also known as GHSA-224j-3632-5gqr.