Headline

CVE-2017-20094: Persistent Cross-Site Scripting in the WordPress NewStatPress plugin

A vulnerability, which was classified as problematic, has been found in NewStatPress Plugin 1.2.4. This issue affects some unknown processing. The manipulation leads to basic cross site scripting (Persistent). The attack may be initiated remotely. Upgrading to version 1.2.5 is able to address this issue. It is recommended to upgrade the affected component.

2 years ago

CVE

Open in Source

#xss #vulnerability #web #git #java #wordpress

Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev

Full Disclosure mailing list archives

From: Summer of Pwnage <lists () securify nl>
Date: Wed, 1 Mar 2017 07:05:22 +0100

------------------------------------------------------------------------ Persistent Cross-Site Scripting in the WordPress NewStatPress plugin

Han Sahin, July 2016

Abstract

A persistent Cross-Site Scripting (XSS) vulnerability has been found in the WordPress NewStatPress plugin. By using this vulnerability an attacker can inject malicious JavaScript code into the application, which will execute within the browser of any user who views the relevant application content.

OVE ID

OVE-20160712-0030

Tested versions

This issue was successfully tested on WordPress NewStatPress plugin version 1.2.4.

Fix

This issue has been addressed in NewStatPress version 1.2.5. This version can be download from the NewStatPress GitHub account: https://github.com/lechab/newstatpress#125

Details

https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_in_the_wordpress_newstatpress_plugin.html

Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its goal is to contribute to the security of popular, widely used OSS projects in a fun and educational way.

_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/

Current thread: