CVE-2021-4074

MEDIUM 5.4CVE-2021-4074 · Published 18/01/2022 · updated 17/06/2026

In short

CVE-2021-4074 is a MEDIUM (CVSS 5.4) vulnerability affecting whmcs bridge (i-plugins).
Chance of exploitation in the next 30 days (EPSS): 0.56%, higher than 46.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
whmcs bridge i-plugins	`≤ 6.1`	No fix yet

Description

The WHMCS Bridge WordPress plugin is vulnerable to Stored Cross-Site Scripting via the cc_whmcs_bridge_url parameter found in the ~/whmcs-bridge/bridge_cp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.1. Due to missing authorization checks on the cc_whmcs_bridge_add_admin function, low-level authenticated users such as subscribers can exploit this vulnerability.

References

plugins.trac.wordpress.org/changeset · Issue Tracking
wordfence.com/vulnerability-advisories · Third Party Advisory

More vulnerabilities in whmcs bridge

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free