漏洞描述
The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected cross-site scripting attack by injecting malicious code in the request path.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
wpscan.comhttps://wpscan.com/vulnerability/5e0bf0b6-9809-426b-b1d4-1fb653083b58↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-39322↗www.wordfence.comhttps://www.wordfence.com/vulnerability-advisories/#CVE-2021-39322↗wpvulndb.comhttps://wpvulndb.com/vulnerabilities/5e0bf0b6-9809-426b-b1d4-1fb653083b58↗github.comhttps://github.com/ARPSyndicate/cvemon↗