CVE-2021-34656 - 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat <= 5.2.7 Reflected Cross-Site Scripting

Back Back to CVE browser

MEDIUM

2Way VideoCalls and Random Chat - HTML5 Webcam Videochat <= 5.2.7 Reflected Cross-Site Scripting

Published Aug 16, 2021

6.1

MEDIUM

CVSS 3.1

EPSS 0.90%

Description

The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `vws_notice` function found in the ~/inc/requirements.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.2.7.

Affected products

Vendor 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat Product 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat Default
n/a
- Version
  5.2.7
  Status
  affected
  Constraints
  <=5.2.7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

2Way VideoCalls and Random Chat - HTML5 Webcam Videochat

n/a

Version	Status	Constraints
5.2.7	affected	<=5.2.7

Remediation

Vendor solution

Uninstall the plugin

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-21306
Advisory
https://plugins.trac.wordpress.org/browser/webcam-2way-videochat/trunk/inc/requirements.php#L182
x_refsource_MISCExploitThird Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34656
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-21306		Advisory
https://plugins.trac.wordpress.org/browser/webcam-2way-videochat/trunk/inc/requirements.php#L182		x_refsource_MISCExploitThird Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34656		x_refsource_MISCExploitThird Party Advisory