Cross-site scripting in WordPress Video Lead Form

Posted: December 4, 2012 in Vulnerabilities
Tags: , , ,
0

Wordpress Vulnerability

XSS in WordPress

Vulnerability: Cross-site scripting in WordPress Video Lead Form

Danger: Low
Patch: Yes
Number of vulnerabilities: 1

Vector of operation: Remote
Impact: Cross Site Scripting

Affected products: WordPress Video Lead Form Plugin 0.x

Affected versions: WordPress Video Lead Form 0.5, maybe earlier.

Description:

The vulnerability allows malicious people to conduct XSS attacks.

The vulnerability is caused due to insufficient input validation in the parameter ‘errMsg’ in script wp-admin/admin.php (when the parameter ‘page’ is ‘video-lead-form’). This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Manufacturer URL: http://wordpress.org/extend/plugins/video-lead-form/

Solution: Install the latest version 0.6 from the manufacturer.

links:

http://packetstormsecurity.org/files/118466/WordPress-Video-Lead-Form-0.5-Cross-Site-Scripting.html

Leave a Reply

Fill in your details below or click an icon to log in:

Gravatar
WordPress.com Logo

You are commenting using your WordPress.com account. ( Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. ( Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. ( Log Out /  Change )

Cancel

Connecting to %s