PT-2018-9615

CVE-2018-1002007

Published

2018-12-03

Updated

2018-12-27

Description by

CVSS 3.1

4.8

Medium

MetricsAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: WordPress Arigato Autoresponder and News letter version 2.5.1.8

Description: The issue is related to a reflected XSS vulnerability that requires administrative privileges to exploit. It is located in the integration-contact-form.html.php file at line 15 and can be triggered via a POST request using the html id variable.

Recommendations: For WordPress Arigato Autoresponder and News letter version 2.5.1.8, consider restricting access to the integration-contact-form.html.php file until a patch is available, and avoid using the html id variable in POST requests to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Larry W. Cashdollar

Larry0

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers