CVE-2021-36866 in Fatcat Apps Easy Pricing Tables Plugin
Summary
by MITRE • 06/02/2022
Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Easy Pricing Tables plugin
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 06/05/2022
The vulnerability CVE-2021-36866 represents a stored cross-site scripting flaw within the Fatcat Apps Easy Pricing Tables WordPress plugin, affecting users with author or higher privileges. This issue resides in the plugin's handling of user-generated content within pricing table configurations, where malicious actors with appropriate access levels can inject persistent malicious scripts that execute in the contexts of other users who view the affected content. The vulnerability specifically impacts the plugin's administrative interface where pricing table data is stored and subsequently rendered to end users, creating a persistent threat vector that can compromise multiple users simultaneously.
The technical exploitation of this vulnerability occurs through the manipulation of input fields within the pricing table editor interface, where the plugin fails to properly sanitize or escape user-supplied content before storing it in the database. When administrators or authors create or modify pricing table entries, they can include malicious javascript payloads within text fields, button labels, or other editable components. These payloads are then stored persistently and executed whenever other users view the pricing tables, particularly those with lower privileges who may not be aware of the malicious content. The vulnerability is classified as a stored XSS due to the persistence of the malicious script in the application's data store rather than a reflected or DOM-based variant.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to perform various malicious activities including session hijacking, credential theft, data exfiltration, and privilege escalation within the affected WordPress environment. An attacker with author-level access can craft payloads that redirect users to malicious domains, steal cookies and session tokens, or inject additional malicious code that could lead to complete compromise of the WordPress installation. The vulnerability is particularly concerning in multi-user environments where administrators may unknowingly approve malicious content or where authors have access to sensitive pricing information that could be exploited for financial gain or corporate espionage. This type of vulnerability directly relates to CWE-79 which defines cross-site scripting flaws as the injection of malicious code into web applications, and can be mapped to ATT&CK technique T1566.001 for initial access through malicious content.
Mitigation strategies for CVE-2021-36866 should prioritize immediate plugin updates to versions that address the XSS vulnerability, as the vendor has likely released patches to sanitize input fields and properly escape output rendering. Organizations should implement strict input validation and output encoding mechanisms within their WordPress installations, particularly for plugins that handle user-generated content. Role-based access controls should be enforced to limit the ability of lower-privilege users to inject potentially malicious content, while also implementing content security policies to prevent execution of unauthorized scripts. Regular security audits of plugin configurations and user access permissions should be conducted to identify and remediate similar vulnerabilities. Additionally, implementing web application firewalls and monitoring systems that can detect and block suspicious script injection attempts provides an additional layer of protection against exploitation of this type of vulnerability.