PT-2018-9615

CVE-2018-1002007

Publicado

2018-12-03

Atualizado

2018-12-27

Descrição por

CVSS 3.1

4.8

Média

MétricasAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: WordPress Arigato Autoresponder and News letter version 2.5.1.8

Description: The issue is related to a reflected XSS vulnerability that requires administrative privileges to exploit. It is located in the integration-contact-form.html.php file at line 15 and can be triggered via a POST request using the html id variable.

Recommendations: For WordPress Arigato Autoresponder and News letter version 2.5.1.8, consider restricting access to the integration-contact-form.html.php file until a patch is available, and avoid using the html id variable in POST requests to minimize the risk of exploitation.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Larry W. Cashdollar

Larry0

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Identificadores relacionados