Subscribe to Comments WordPress Plugin Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	37105
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 16 2006 12:00AM
Updated:	Nov 23 2009 11:25PM
Credit:	MustLive
Vulnerable:	Mark Jaquith Subscribe to Comments 2.0.4 Mark Jaquith Subscribe to Comments 2.0.2 Mark Jaquith Subscribe to Comments 0
Not Vulnerable:	Mark Jaquith Subscribe to Comments 2.0.8

Subscribe to Comments WordPress Plugin Multiple Cross Site Scripting Vulnerabilities

The Subscribe to Comments plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials; other attacks are also possible.

Versions prior to Subscribe to Comments 2.0.8 are vulnerable.

Subscribe to Comments WordPress Plugin Multiple Cross Site Scripting Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.

The following example URIs are available:

• /data/vulnerabilities/exploits/37105.txt

Subscribe to Comments WordPress Plugin Multiple Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references for details.

Subscribe to Comments WordPress Plugin Multiple Cross Site Scripting Vulnerabilities

References:

• Subscribe to Comments Homepage (Mark Jaquith)
  
• Vulnerability in Subscribe To Comments WordPress plugin (MustLive)
  
• Vulnerabilities in plugins for WordPress ('MustLive' )