Cross-site scripting in WordPress Count Per Day

Posted: September 3, 2012 in Vulnerabilities
Tags: , , , ,

Wordpress VulnerabilityAffected products: Count Per Day 3.x (plugin for WordPress)

Affected versions: WordPress Count Per Day 3.2.3, possibly earlier.

Description:

The vulnerability allows malicious people to conduct XSS attacks.

The vulnerability is caused due to insufficient input validation in the parameter “note” in the script wp-content/plugins/count-per-day/notes.php. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Manufacturer URL: http://wordpress.org/extend/plugins/count-per-day/

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s