XSS in WordPress
Vulnerability: XSS in WordPress WP e-Commerce Predicitive Search
Danger: Low
Patch: Yes
Number of vulnerabilities: 1
Vector of operation: Remote
Impact: Cross Site Scripting
Affected products: WordPress WP e-Commerce Predictive Search Plugin 1.x
Affected versions: WordPress WP e-Commerce Predicitive Search 1.1.1, possibly earlier.
Description:
The vulnerability allows malicious people to conduct XSS attacks.
The vulnerability is caused due to insufficient input validation in the parameter “rs” in the script index.php (when the parameter “page_id” is intellectual search page). This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.
Manufacturer URL: http://wordpress.org/extend/plugins/wp-e-commerce-predictive-search/
Solution: Update to version 1.1.2 from the manufacturer.
links:
http://wordpress.org/extend/plugins/wp-e-commerce-predictive-search/changelog/
