CyberSec.Space Logo
Back to CVE Browser

CVE-2021-38337

MEDIUM
6.1
CVSS Severity Score
EPSS Score0.1510%
EPSS Percentile2.02th
PublishedSep 10, 2021
Last ModifiedNov 21, 2024

Vulnerability Description

The RSVPMaker Excel WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/phpexcel/PHPExcel/Shared/JAMA/docs/download.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1.

Affected Platforms (CPE)

📦
Carrcommunications

Rsvpmaker Excel

<= 1.1

References & Advisories

🔗 https://plugins.trac.wordpress.org/browser/rsvpmaker-excel/tags/1.2/phpexcel/PHPExcel/Shared/JAMA/docs/download.php#L61
🔗 https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38337
🔗 https://plugins.trac.wordpress.org/browser/rsvpmaker-excel/tags/1.2/phpexcel/PHPExcel/Shared/JAMA/docs/download.php#L61
🔗 https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38337

Related Vulnerabilities

CVE-2026-53430

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Mes...

CVE-2026-48854

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust...

CVE-2026-48853

Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc all...

CVE-2026-487237.8

The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36...