MALWARELIST.net – Your Information Security Source

Vulnerability: Cross-site scripting WordPress Token Manager Plugin

Danger: Low
Number of vulnerabilities: 1
Impact: Cross Site Scripting
Affected products: WordPress Token Manager Plugin 1.x

Affected versions: WordPress Token Manager Plugin 1.0.2, possibly earlier

Description:

The vulnerability allows malicious people to conduct XSS attacks.

The vulnerability is caused due to insufficient input validation in the parameter “tid” in script wp-admin/admin.php, when the parameter “page” is “tokenmanageredit” or “tokenmanagertypeedit”. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Manufacturer URL: http://wordpress.org/extend/plugins/token-manager/

Solution: The way to eliminate the vulnerability does not exist at present.

links:

http://packetstormsecurity.org/files/116837/Wordpress-Plugin-Token-Manager-Cross-Site-Scripting.html