WordPress Ultimate Product Catalogue Plugin Multiple Security Vulnerabilities
BID:74466
Info
WordPress Ultimate Product Catalogue Plugin Multiple Security Vulnerabilities
| Bugtraq ID: | 74466 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 05 2015 12:00AM |
| Updated: | May 05 2015 12:00AM |
| Credit: | Felipe Molina de la Torre |
| Vulnerable: |
WordPress Ultimate Product Catalogue 3.1.2 |
| Not Vulnerable: |
WordPress Ultimate Product Catalogue 3.1.5 |
Discussion
WordPress Ultimate Product Catalogue Plugin Multiple Security Vulnerabilities
Ultimate Product Catalogue plugin for WordPress is prone to the following security vulnerabilities:
1. Multiple cross-site scripting vulnerabilities
2. Multiple cross-site request-forgery vulnerabilities
3. An arbitrary file-upload vulnerability
An attacker may leverage these issues to perform unauthorized actions in the context of a user's session, execute arbitrary script code in the context of the vulnerable site, potentially allowing the attacker to steal cookie-based authentication credentials and to upload arbitrary files to the affected application.
Ultimate Product Catalogue plugin for WordPress is prone to the following security vulnerabilities:
1. Multiple cross-site scripting vulnerabilities
2. Multiple cross-site request-forgery vulnerabilities
3. An arbitrary file-upload vulnerability
An attacker may leverage these issues to perform unauthorized actions in the context of a user's session, execute arbitrary script code in the context of the vulnerable site, potentially allowing the attacker to steal cookie-based authentication credentials and to upload arbitrary files to the affected application.