WordPress WonderPlugin Audio Player Plugin Multiple Cross Site Scripting Vulnerabilities
BID:74851
Info
WordPress WonderPlugin Audio Player Plugin Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 74851 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-2218 |
| Remote: | Yes |
| Local: | No |
| Published: | May 03 2015 12:00AM |
| Updated: | May 03 2015 12:00AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
Magic Hills WonderPlugin Audio Player 2.0 |
| Not Vulnerable: |
Magic Hills WonderPlugin Audio Player 2.1 |
Discussion
WordPress WonderPlugin Audio Player Plugin Multiple Cross Site Scripting Vulnerabilities
The WonderPlugin Audio Player plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Versions prior to WonderPlugin Audio Player plugin 2.1 are vulnerable.
The WonderPlugin Audio Player plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Versions prior to WonderPlugin Audio Player plugin 2.1 are vulnerable.
Exploit / POC
WordPress WonderPlugin Audio Player Plugin Multiple Cross Site Scripting Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI.
To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI.
References
WordPress WonderPlugin Audio Player Plugin Multiple Cross Site Scripting Vulnerabilities
References:
References:
- WonderPlugin Audio Player Home Page (wonderplugin)
- WonderPlugin Audio Player 2.0 Blind SQL Injection and XSS (szurek.pl)