Description

A DOM XSS vulnerability exists in a special endpoint of Ghost CMS used only during the development of 4.0.0. The endpoint interacts with its DOM in an insecure way.

Remediation

Upgrade to the latest version of Ghost CMS

References

DOM XSS in Theme Preview

Related Vulnerabilities

WordPress Plugin Visitors Online by BestWebSoft Cross-Site Scripting (0.9)

WordPress Plugin WP Open Social Cross-Site Scripting (5.0)

WordPress Plugin Visitor Maps and Who's Online Cross-Site Scripting (1.5.8.6)

WordPress Plugin WP Instagram-Best Instagram Feeds Cross-Site Scripting (1.0.19)

WordPress Plugin Geo Mashup Cross-Site Scripting (1.8.2)

Severity

High

Classification

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

XSS CWE-79 CVE-2021-29484