MALWARELIST.net – Your Information Security Source

XSS in WordPress

Vulnerability: Cross-site scripting in WordPress post-views

Danger: Low
Number of vulnerabilities: 1

Vector of operation: Remote
Impact: Cross Site Scripting

Affected products: WordPress post-views Plugin 2.x

Affected versions: WordPress post-views 2.6.1, possibly earlier.

Description:

The vulnerability allows malicious people to conduct XSS attacks.

The vulnerability is caused due to insufficient input validation in the parameter “search_input” in script wp-admin/index.php (when the parameter “page” is “post-views”). This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Manufacturer URL: http://wordpress.org/extend/plugins/post-views/

Vulnerability: Cross-site scripting in WordPress Carousel Slideshow

Danger: Low
Patch: Yes
Number of vulnerabilities: 1

Vector of operation: Remote
Impact: Cross Site Scripting

Affected products: WordPress Carousel Slideshow Plugin 3.x

Affected versions: WordPress Carousel Slideshow 3.10, possibly earlier.

Description:

The vulnerability allows malicious people to conduct XSS attacks.

Manufacturer URL: http://wordpress.org/extend/plugins/wp-carouselslideshow/

Solution: Update to version 3.11 from the manufacturer.

Links:
http://wordpress.org/extend/plugins/wp-carouselslideshow/changelog/