Security readout for executives and security teams
Plain-English summary
This affects WordPress sites using Alexander Ustimenko's Psychological tests & quizzes plugin at version 0.21.19 or older. A logged-in user with contributor or higher rights could store script content that later runs in another user's browser. Impact is moderate: it can expose data or alter page behavior, but requires an authenticated user and victim interaction.
Executive priority
Treat this as a moderate-priority web application issue. It is not shown as actively exploited in the supplied evidence, but it can affect visitor or administrator browser trust if an untrusted contributor account exists. Prioritize sites with many content users or weak account governance.
Technical view
CVE-2021-36867 is an authenticated stored XSS issue in the WordPress Psychological tests & quizzes plugin <= 0.21.19. The CVSS 3.1 score is 5.4 with low attack complexity, low privileges required, user interaction required, changed scope, low confidentiality impact, low integrity impact, and no availability impact. The weakness maps to CWE-79.
Likely exposure
Exposure is limited to WordPress installations running the wp-testing plugin at version 0.21.19 or earlier, especially sites allowing contributor-level or higher accounts. Sites without this plugin, or without untrusted authenticated content creators, are not indicated as affected by the provided sources.
Exploitation context
The source bundle does not identify active exploitation, and the CVE is not listed as KEV. Exploitation requires authenticated access with contributor or higher rights and a separate user interaction event. The provided evidence does not include public exploit details or a confirmed patch version.
Researcher notes
The strongest evidence is the CVE/Patchstack description: authenticated stored XSS in wp-testing <= 0.21.19. The bundle does not provide sink/source detail, proof-of-concept material, exploit prevalence, or a named fixed version. Validate exposure through asset inventory and version checks rather than assumptions.
Mitigation direction
- Inventory WordPress sites for the Psychological tests & quizzes plugin.
- Check vendor and Patchstack guidance for a fixed version or removal advice.
- Restrict contributor or higher roles to trusted users only.
- Disable or remove the plugin if no supported fixed release is available.
- Review plugin-created content for unexpected scripts or suspicious changes.
Validation and detection
- Confirm whether wp-testing is installed on each WordPress site.
- Record installed plugin versions and flag versions <= 0.21.19.
- Review users with contributor, author, editor, or administrator roles.
- Check vendor and Patchstack pages for current remediation guidance.
- Verify that risky plugin content is reviewed or removed.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-36867 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N2.32.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://wordpress.org/plugins/wp-testing/CVE reference · x_refsource_CONFIRM
- https://patchstack.com/database/vulnerability/wp-testing/wordpress-psychological-tests-quizzes-plugin-0-21-19-authenticated-stored-cross-site-scripting-xss-vulnerabilityCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.