Vulnerability: Cross-site scripting WordPress Count per Day
Danger level: Low
Patch: None
Number of vulnerabilities: 1
Operation vector: Remote
Impact: Cross Site Scripting
Affected products: WordPress Count per Day Plugin 3.x
Affected versions: WordPress Count per Day 3.2.5, possibly earlier.
Description:
The vulnerability allows malicious people to conduct XSS attacks.
The vulnerability is caused due to insufficient input validation in the parameter “daytoshow” in script wp-content/wp-admin/index.php (when the parameter “page” is “cpd_metaboxes”). This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site. (more…)