Posts Tagged ‘WordPress Events Manager’

Wordpress VulnerabilityVulnerability: Cross-site scripting WordPress Count per Day

Danger level: Low
Patch: None
Number of vulnerabilities: 1

Operation vector: Remote
Impact: Cross Site Scripting

Affected products: WordPress Count per Day Plugin 3.x

Affected versions: WordPress Count per Day 3.2.5, possibly earlier.


The vulnerability allows malicious people to conduct XSS attacks.

The vulnerability is caused due to insufficient input validation in the parameter “daytoshow” in script wp-content/wp-admin/index.php (when the parameter “page” is “cpd_metaboxes”). This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site. (more…)