PT-2020-7841
CVE-2015-4039
·
تاريخ النشر
2020-01-06
·
تاريخ التحديث
2020-01-13
الوصف من
CVSS 2.0
3.5
منخفضةالمقاييسAV:N/AC:M/Au:S/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions:
WP Membership plugin version 1.2.3
Description:
The issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified profile fields or new post content, potentially leading to cross-site scripting (XSS) attacks. This can be used to bypass the administrator confirmation step for new post content.
Recommendations:
For WP Membership plugin version 1.2.3, update to a version that fixes the XSS vulnerabilities to prevent arbitrary web script or HTML injection. As a temporary workaround, consider restricting access to profile fields and new post content to minimize the risk of exploitation.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾