CVE-2021-38330: 
WordPress vulnerability analysis and mitigation

The Yet Another bol.com Plugin (YABP) WordPress plugin was found to contain a Reflected Cross-Site Scripting vulnerability, identified as CVE-2021-38330. The vulnerability was discovered in versions up to and including 1.4, with the initial disclosure occurring on August 9, 2021. The security flaw was identified in the ~/yabp.php file where an unvalidated $SERVER["PHPSELF"] value could be exploited (CVE Details, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It received a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability stems from improper handling of the $SERVER["PHPSELF"] value in the yabp.php file, which could allow attackers to inject arbitrary web scripts (NVD, Wordfence Advisory).

The vulnerability allows attackers to perform cross-site scripting attacks, potentially leading to the injection of malicious web scripts. This could result in compromised user sessions, theft of sensitive information, or manipulation of the affected website's content (NVD).