WordPress Quick Page/Post Redirect Plugin Multiple Input Validation Vulnerabilities

Bugtraq ID:	66790
Class:	Input Validation Error
CVE:	CVE-2014-2598
Remote:	Yes
Local:	No
Published:	Apr 11 2014 12:00AM
Updated:	Apr 11 2014 12:00AM
Credit:	Tom Adams
Vulnerable:
Not Vulnerable:

WordPress Quick Page/Post Redirect Plugin Multiple Input Validation Vulnerabilities

Quick Page/Post Redirect plugin for WordPress is prone to cross-site request-forgery and HTML-injection vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions, execute arbitrary script or HTML code within the context of the browser, and steal cookie-based authentication credentials. Other attacks are also possible.

Quick Page/Post Redirect plugin prior to 5.0.5 are vulnerable.

WordPress Quick Page/Post Redirect Plugin Multiple Input Validation Vulnerabilities

Attackers can exploit these issues using browser. To exploit the cross-site request-forgery vulnerability, the attacker must entice an unsuspecting victim to visit a specially-crafted webpage.

The following example data is available :

• /data/vulnerabilities/exploits/66790.txt

WordPress Quick Page/Post Redirect Plugin Multiple Input Validation Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

WordPress Quick Page/Post Redirect Plugin Multiple Input Validation Vulnerabilities

References: