{"vulnerability": "cve-2021-25067", "sightings": [{"uuid": "fb8f974b-ff96-4d97-9547-e6c45e682c53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25067", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-25067.yaml", "content": "", "creation_timestamp": "2023-04-27T09:58:59.000000Z"}, {"uuid": "f2cafff3-714e-48e0-936c-0b12232fbee4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25067", "type": "seen", "source": "https://t.me/cibsecurity/35672", "content": "\u203c CVE-2021-25067 \u203c\n\nThe Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpb_post admin page.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-01-17T16:23:26.000000Z"}, {"uuid": "1ef6465e-a504-4b61-87c3-f537e6827faa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25067", "type": "seen", "source": "https://t.me/hacking_Attack/51196", "content": ".  You can then manually test whether indeed this place (remember: in blue you have the  endpoint name, here: the menu page name) is vulnerable to XSS.  In this case, it is: CVE-2021-25067 (https://wpscan.com/vulnerability/365007f0-61ac-4e81-8a3a-3a068f2c84bc).  Option update leading to stored XSS  ./bin/fuzz_plugin duplicate-page-or-post --version 1.4.6    After printing the results, you will see update_option being called:\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:43.349859Z"}, {"uuid": "3dd3eed5-a640-47b7-8845-164562ca433e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25067", "type": "seen", "source": "https://t.me/hacking_Attack/51213", "content": "KitPloit - PenTest Tools!\nWpgarlic - A Proof-Of-Concept WordPress Plugin Fuzzer\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjkBAQ43H5hq3CSZznlrHqBCkxr8v2rfZBAkHVZ6QkRm4XdPoG6ullrz_GTyD6mUcATnbT4FcwB7uHJqLaXWbufV5A4Ep2934lsAAUbUMLE2UJUAnKj-qXs9OwToFmiLvkV3CRT5akAZQEgeher2Tco2fmK_xjrJOLwgo7UrcL-sfk9MvYVIcVN01cO=w640-h414 A proof-of-concept WordPress plugin fuzzer used in the research described in https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html that helped to discover  more than 140 vulnerablities in WordPress plugins installed on almost 15 million  sites.\n\nIf you want to continue the research, start with less popular plugins - if a plugin  achieved at least 10k active installs between October 2021 and January 2022, I have  most probably looked at the fuzzer reports (and most focus has been put on plugins having  at least 20k active installs). Because there is a lot of randomness in how fuzzer works,  some vulnerabilities in these plugins remain undiscovered - but fewer ones.\n\nFuzzer reports contain a lot of false positives - most of them don't indicate a vulnerability.  After seeing a report, first analyze whether the behavior you're observing is indeed a vulnerability  or a false positive. Don't spam WPScan/vendors with raw fuzzer reports - provide a PoC exploit  instead. ExamplesFor obvious reasons, the examples will contain only vulnerabilities that have already been fixed. Arbitrary file readLet's assume you are fuzzing responsive-vector-mapsin version 6.4.0: ./bin/fuzz_plugin responsive-vector-maps --version 6.4.0 (to fuzz the latest version, just skip --version).\n\nAfter the fuzzing finishes (which would take 10-30 minutes for this plugin) you can call: ./bin/print_findings data/plugin_fuzz_results/ You will see, among others: https://blogger.googleusercontent.com/img/a/AVvXsEjkBAQ43H5hq3CSZznlrHqBCkxr8v2rfZBAkHVZ6QkRm4XdPoG6ullrz_GTyD6mUcATnbT4FcwB7uHJqLaXWbufV5A4Ep2934lsAAUbUMLE2UJUAnKj-qXs9OwToFmiLvkV3CRT5akAZQEgeher2Tco2fmK_xjrJOLwgo7UrcL-sfk9MvYVIcVN01cO=w640-h414 .\n\nThat means that the fuzzer detected executing fopen()on a known payload.  Most of the payloads contain the word GARLICin them to facilitate automatic  detection in output. You may see or configure them in docker_image/magic_payloads.php.\n\nThen, you may browse the source code and see that indeed the wp_ajax_rvm_import_markersendpoint uses the file content to render output, thus allowing you to read arbitrary files  on the server: CVE-2021-24947.\n\nWhat you see in white is a crash considered interesting (you may modify them or add new ones  in crash_detectors.py). Green is the context. In blue you see the report file name  (with plugin name), plugin popularity and endpoint name (here: the ajax action name).\n\nThe data in yellow are what payloads were injected into what variables. Reflected XSSLet's assume you are fuzzing page-builder-addin version 1.4.9.4: ./bin/fuzz_plugin page-builder-add --version 1.4.9.4 After printing the results, you will see known payload echoed back: https://blogger.googleusercontent.com/img/a/AVvXsEhrUnJW0UZ1H8fvpix5si6P3UVilMDfzcALLOecAJ9uIL0tFQ3HtsoJTeptqSZ6iutBld00FevHnNdD9Kw_hKJJW4T4YmhQBnHvgmjVY11AblTzFj7ZcnjDAZP49cgYk-bmNUILi4SnNWDOn7NqE1qTUc_dwj49tdzxXcNhrCOqkUMTOVntw4LEJAqp=w640-h266 .\n\nYou can then manually test whether indeed this place (remember: in blue you have the  endpoint name, here: the menu page name) is vulnerable to XSS.  In this case, it is: CVE-2021-25067. Option update leading to stored XSS./bin/fuzz_plugin duplicate-page-or-post --version 1.4.6 After printing the results, you will see update_optionbeing called: https://blogger.googleusercontent.com/img/a/AVvXsEhA7I4LmJBYgic2K63V4P5zyyo8qgLvr6RtX0_Q3uXK3GMmc4djjy_CyicRuzRrmLdg9n1BpVZ-XRa1G[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:43.229720Z"}, {"uuid": "57aa9e4e-e3c2-4e28-b74f-52e0df671f94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25067", "type": "seen", "source": "https://t.me/hacking_Attack/51213", "content": "KitPloit - PenTest Tools!\nWpgarlic - A Proof-Of-Concept WordPress Plugin Fuzzer\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjkBAQ43H5hq3CSZznlrHqBCkxr8v2rfZBAkHVZ6QkRm4XdPoG6ullrz_GTyD6mUcATnbT4FcwB7uHJqLaXWbufV5A4Ep2934lsAAUbUMLE2UJUAnKj-qXs9OwToFmiLvkV3CRT5akAZQEgeher2Tco2fmK_xjrJOLwgo7UrcL-sfk9MvYVIcVN01cO=w640-h414 A proof-of-concept WordPress plugin fuzzer used in the research described in https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html that helped to discover  more than 140 vulnerablities in WordPress plugins installed on almost 15 million  sites.\n\nIf you want to continue the research, start with less popular plugins - if a plugin  achieved at least 10k active installs between October 2021 and January 2022, I have  most probably looked at the fuzzer reports (and most focus has been put on plugins having  at least 20k active installs). Because there is a lot of randomness in how fuzzer works,  some vulnerabilities in these plugins remain undiscovered - but fewer ones.\n\nFuzzer reports contain a lot of false positives - most of them don't indicate a vulnerability.  After seeing a report, first analyze whether the behavior you're observing is indeed a vulnerability  or a false positive. Don't spam WPScan/vendors with raw fuzzer reports - provide a PoC exploit  instead. ExamplesFor obvious reasons, the examples will contain only vulnerabilities that have already been fixed. Arbitrary file readLet's assume you are fuzzing responsive-vector-mapsin version 6.4.0: ./bin/fuzz_plugin responsive-vector-maps --version 6.4.0 (to fuzz the latest version, just skip --version).\n\nAfter the fuzzing finishes (which would take 10-30 minutes for this plugin) you can call: ./bin/print_findings data/plugin_fuzz_results/ You will see, among others: https://blogger.googleusercontent.com/img/a/AVvXsEjkBAQ43H5hq3CSZznlrHqBCkxr8v2rfZBAkHVZ6QkRm4XdPoG6ullrz_GTyD6mUcATnbT4FcwB7uHJqLaXWbufV5A4Ep2934lsAAUbUMLE2UJUAnKj-qXs9OwToFmiLvkV3CRT5akAZQEgeher2Tco2fmK_xjrJOLwgo7UrcL-sfk9MvYVIcVN01cO=w640-h414 .\n\nThat means that the fuzzer detected executing fopen()on a known payload.  Most of the payloads contain the word GARLICin them to facilitate automatic  detection in output. You may see or configure them in docker_image/magic_payloads.php.\n\nThen, you may browse the source code and see that indeed the wp_ajax_rvm_import_markersendpoint uses the file content to render output, thus allowing you to read arbitrary files  on the server: CVE-2021-24947.\n\nWhat you see in white is a crash considered interesting (you may modify them or add new ones  in crash_detectors.py). Green is the context. In blue you see the report file name  (with plugin name), plugin popularity and endpoint name (here: the ajax action name).\n\nThe data in yellow are what payloads were injected into what variables. Reflected XSSLet's assume you are fuzzing page-builder-addin version 1.4.9.4: ./bin/fuzz_plugin page-builder-add --version 1.4.9.4 After printing the results, you will see known payload echoed back: https://blogger.googleusercontent.com/img/a/AVvXsEhrUnJW0UZ1H8fvpix5si6P3UVilMDfzcALLOecAJ9uIL0tFQ3HtsoJTeptqSZ6iutBld00FevHnNdD9Kw_hKJJW4T4YmhQBnHvgmjVY11AblTzFj7ZcnjDAZP49cgYk-bmNUILi4SnNWDOn7NqE1qTUc_dwj49tdzxXcNhrCOqkUMTOVntw4LEJAqp=w640-h266 .\n\nYou can then manually test whether indeed this place (remember: in blue you have the  endpoint name, here: the menu page name) is vulnerable to XSS.  In this case, it is: CVE-2021-25067. Option update leading to stored XSS./bin/fuzz_plugin duplicate-page-or-post --version 1.4.6 After printing the results, you will see update_optionbeing called: https://blogger.googleusercontent.com/img/a/AVvXsEhA7I4LmJBYgic2K63V4P5zyyo8qgLvr6RtX0_Q3uXK3GMmc4djjy_CyicRuzRrmLdg9n1BpVZ-XRa1G[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:55.036179Z"}, {"uuid": "5577bcda-698c-4c62-8afe-1236e01dbda6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25067", "type": "seen", "source": "https://t.me/hacking_Attack/51196", "content": ".  You can then manually test whether indeed this place (remember: in blue you have the  endpoint name, here: the menu page name) is vulnerable to XSS.  In this case, it is: CVE-2021-25067 (https://wpscan.com/vulnerability/365007f0-61ac-4e81-8a3a-3a068f2c84bc).  Option update leading to stored XSS  ./bin/fuzz_plugin duplicate-page-or-post --version 1.4.6    After printing the results, you will see update_option being called:\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:55.122619Z"}]}