CVE-2018-7197

2018-02-1803:29:00

Google

osv.dev

5.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.8%

JSON

An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting (XSS) vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL.

CPENameOperatorVersion
pluckeq4.7.2
pluckeq4.7
pluckeq4.7.3
pluckeq4.7.4

Name	Operator	Version
pluck	eq	4.7.2
pluck	eq	4.7
pluck	eq	4.7.3
pluck	eq	4.7.4

References

github.com/pluck-cms/pluck/issues/47