CVE-2021-30134

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-12-26 · updated 2026-06-17
Weakness: CWE-79

Description

php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php.

Affected products

Ht Slider Range For Amazon Affiliates Project Ht Slider Range For Amazon Affiliates: before 1.1.6 — fixed in 1.1.6
Php Curl Class Project Php Curl Class: before 2.3.2 — fixed in 2.3.2
Ptwooplugins Invoicing With Invoicexpress For Woocommerce: before 3.0.3 — fixed in 3.0.3
Qiwi Woo-Qiwi-Payment-Gateway: through 0.0.9
Shopello Api Project Shopello Api: through 2.9.0
Teamleader Crm Forms: before 2.1.0 — fixed in 2.1.0

How to fix

Upgrade to a fixed version: Ht Slider Range For Amazon Affiliates Project Ht Slider Range For Amazon Affiliates 1.1.6; Php Curl Class Project Php Curl Class 2.3.2; Ptwooplugins Invoicing With Invoicexpress For Woocommerce 3.0.3; Teamleader Crm Forms 2.1.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-30134 or the next vulnerability affects your stack