WpvulndbWPVDB-ID:56779EE5-5BF4-47D2-BBAF-B398EA926FBEWP Statistics < 14.5.1 - Unauthenticated Stored Cross-Site Scripting
7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
0.0004 Low
EPSS
Percentile
9.0%
Description The plugin does not properly escape visited URLs which are reflected on the plugin’s dashboard.
PoC
Visit one same page multiple times so it makes it to the most visited pages, adding the following “utm_id” parameter to it: http://vulnerable-site.tld/attacked-page/?utm_id="><img%2Fsrc=x onerror%3Dalert(123)%2F%2F>
| CPE | Name | Operator | Version |
|---|---|---|---|
| eq | 14.5.1 |
Related
7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
0.0004 Low
EPSS
Percentile
9.0%