WordPress Contact Bank Plugin 'Label' Tag HTML Injection Vulnerability
BID:67334
Info
WordPress Contact Bank Plugin 'Label' Tag HTML Injection Vulnerability
| Bugtraq ID: | 67334 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-3841 |
| Remote: | Yes |
| Local: | No |
| Published: | May 12 2014 12:00AM |
| Updated: | May 29 2014 06:20AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
WordPress Contact Bank Plugin 'Label' Tag HTML Injection Vulnerability
Contact Bank plugin for WordPress is prone to an HTML-injection vulnerability.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
WordPress Contact Bank prior to 2.0.20 are vulnerable.
Contact Bank plugin for WordPress is prone to an HTML-injection vulnerability.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
WordPress Contact Bank prior to 2.0.20 are vulnerable.
Exploit / POC
WordPress Contact Bank Plugin 'Label' Tag HTML Injection Vulnerability
Attackers can exploit this issue using browser.
Attackers can exploit this issue using browser.
Solution / Fix
WordPress Contact Bank Plugin 'Label' Tag HTML Injection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
WordPress Contact Bank Plugin 'Label' Tag HTML Injection Vulnerability
References:
References: