CVE-2021-3135

moderate-risk

Published 2021-07-19

An issue was discovered in the tagDiv Newspaper theme 10.3.9.1 for WordPress. It allows XSS via the wp-admin/admin-ajax.php td_block_id parameter in a td_ajax_block API call.

Do I need to act?

0.44% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.1/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Newspaper

Affected Vendors

Tagdiv

References (4)

Release Notes https://tagdiv.com/newspaper/

Third Party Advisory https://themeforest.net/item/newspaper/5489609

Release Notes https://tagdiv.com/newspaper/

Third Party Advisory https://themeforest.net/item/newspaper/5489609

/ 100

moderate-risk

Severity 23/34 · High

Exploitability 2/34 · Minimal

Exposure 5/34 · Minimal