Lucene search

VulDBCVE-2015-10120

HistoryJul 10, 2023 - 4:15 p.m.

CVE-2015-10120

2023-07-1016:15:47

CWE-79

VulDB

web.nvd.nist.gov

vulnerability

wds multisite aggregate plugin

wordpress

remote attack

cross-site scripting

security patch

vdb-233364

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

35.4%

JSON

A vulnerability, which was classified as problematic, was found in WDS Multisite Aggregate Plugin up to 1.0.0 on WordPress. Affected is the function update_options of the file includes/WDS_Multisite_Aggregate_Options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 49e0bbcb6ff70e561365d9e0d26426598f63ca12. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-233364.

Affected configurations

Nvd

Vulners

Node

webdevstudioswds_multisite_aggregateRange≤1.0.0wordpress

VendorProductVersionCPE
webdevstudioswds_multisite_aggregate*cpe:2.3:a:webdevstudios:wds_multisite_aggregate:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
webdevstudios	wds_multisite_aggregate	*	cpe:2.3:a:webdevstudios:wds_multisite_aggregate::::::wordpress::*

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "WDS Multisite Aggregate Plugin",
    "versions": [
      {
        "version": "1.0",
        "status": "affected"
      }
    ]
  }
]

References

github.com/wp-plugins/wds-multisite-aggregate/commit/49e0bbcb6ff70e561365d9e0d26426598f63ca12

vuldb.com/?ctiid.233364

vuldb.com/?id.233364

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

35.4%

JSON

Related for CVE-2015-10120