What this actually is.
Technical background, root cause, and affected surface.
A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a trusted website. The attack targets your application’s users and not the application itself while using your application as the attack’s vehicle. The XSS payload executes whenever the user changes the form values or deletes a created form in Zoho CRM Lead Magnet Version 1.7.2.4.
- Vendor
- Zoho
- Affected Product
- Zoho Lead Magnet Plugin
- CVE
- CVE-2021-33849
- Securin ID
- 2021-CSW-08-1050
- Status
- Fixed
- Date
- September 1, 2021
- Severity
- Medium
- CVSS Score
- 5.4
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CWE
- CWE-79
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
With Cross-Site Scripting, an attacker can control a script executed in the victim’s browser and then fully compromise that user. An XSS vulnerability enables attacks that are self-contained within the application. This means that an attacker does not need to find an external means of inducing the victim to make a request containing their exploit. Rather, the attacker can insert the exploit into the application and simply wait for users to encounter it.
A Cross-Site Scripting attack results in the following:
● Cookie theft
● Disclosure of end-user files
● Installation of Trojan horse programs
● Redirection of user to some other page or site
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Perform context-sensitive encoding of untrusted input before it is echoed back to a browser by using the encoding library.
Implement input validation for special characters on all variables reflected to the browser and stored in the database.
Implement client-side validation.
To fix this vulnerability, follow these steps:
Figure 09: Default Cross-Site Scripting Mitigation Setting in the wp.config File Prevents Cross-site Scripting Attacks
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Discovered in Zoho CRM Lead Magnet Version 1.7.2.4.
Reported to WordPress Team
Vendor Acknowledged
Vendor blocked the plugin
Zoho fixed the issue
Vendor reopened the plugin for download.
CVE Assigned.
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.