WordPress Purity Theme – Cross-site scripting

Posted: September 20, 2012 in Vulnerabilities
Tags: , , , ,
0

Wordpress VulnerabilityVulnerability: Cross-site scripting in the WordPress Purity Theme

Danger: Low
If the Patch: None
Number of vulnerabilities: 1
Impact: Cross Site Scripting
Affected products: WordPress Purity Theme

Affected versions: WordPress Purity TOPIC LINKS

Description:

The vulnerability allows malicious people to conduct XSS attacks.

The vulnerability is caused due to insufficient input validation in the parameter “s” in index.php and the parameters “contactName”, “email”, “subject” and “comments” on the contact page. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Manufacturer URL: http://themeforest.net/item/purity-clean-minimal-bold-wordpress-theme/639774

Solution: The way to eliminate the vulnerability does not exist at present.

links:

http://osvdb.org/show/osvdb/85501
http://osvdb.org/show/osvdb/85502

Leave a Reply

Fill in your details below or click an icon to log in:

Gravatar
WordPress.com Logo

You are commenting using your WordPress.com account. ( Log Out /  Change )

Google photo

You are commenting using your Google account. ( Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. ( Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. ( Log Out /  Change )

Cancel

Connecting to %s