cformsII Plugin for WordPress 'lib_ajax.php' Multiple Cross Site Scripting Vulnerabilities
BID:44587
Info
cformsII Plugin for WordPress 'lib_ajax.php' Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 44587 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-3977 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 01 2010 12:00AM |
| Updated: | Feb 15 2012 05:30PM |
| Credit: | Wagner Elias from Conviso IT Security |
| Vulnerable: |
Oliver Seidel cformsII 13.1 Oliver Seidel cformsII 11.5 |
| Not Vulnerable: |
Oliver Seidel cformsII 13.2 |
Discussion
cformsII Plugin for WordPress 'lib_ajax.php' Multiple Cross Site Scripting Vulnerabilities
The cformsII plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
cformsII 13.1 is vulnerable; other versions may also be affected.
The cformsII plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
cformsII 13.1 is vulnerable; other versions may also be affected.