Headline

CVE-2017-20087: Cross-Site Scripting in Alpine PhotoTile for Instagram WordPress Plugin

A vulnerability, which was classified as problematic, has been found in Alpine PhotoTile for Instagram Plugin 1.2.7.7. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely.

2 years ago

CVE

Open in Source

#xss #vulnerability #web #wordpress

Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev

Full Disclosure mailing list archives

From: Summer of Pwnage <lists () securify nl>
Date: Wed, 1 Mar 2017 07:10:30 +0100

------------------------------------------------------------------------ Cross-Site Scripting in Alpine PhotoTile for Instagram WordPress Plugin

Antonis Manaras, July 2016

Abstract

A Cross-Site Scripting vulnerability was found in the Alpine PhotoTile for Instagram WordPress Plugin. This issue allows an attacker to perform a wide variety of actions, such as stealing Administrators’ session tokens, or performing arbitrary actions on their behalf. In order to exploit this issue, the attacker has to lure/force a logged on WordPress Administrator into opening a malicious website.

OVE ID

OVE-20160725-0010

Tested versions

This issue was successfully tested on Alpine PhotoTile for Instagram WordPress Plugin version 1.2.7.7.

Fix

There is currently no fix available.

Details

https://sumofpwn.nl/advisory/2016/cross_site_scripting_in_alpine_phototile_for_instagram_wordpress_plugin.html

Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its goal is to contribute to the security of popular, widely used OSS projects in a fun and educational way.

_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/

Current thread: