CVE-2011-5257

Опубликовано: 12 фев. 2013

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

Multiple cross-site scripting (XSS) vulnerabilities in the Classipress theme before 3.1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) twitter_id parameter related to the Twitter widget and (2) facebook_id parameter related to the Facebook widget.

Ссылки

http://docs.appthemes.com/classipress/classipress-version-3-1-5/
Vendor Advisory
http://secunia.com/advisories/46658
Vendor Advisory
http://www.exploit-db.com/exploits/18053
Exploit
http://www.osvdb.org/76712
http://docs.appthemes.com/classipress/classipress-version-3-1-5/
Vendor Advisory
http://secunia.com/advisories/46658
Vendor Advisory
http://www.exploit-db.com/exploits/18053
Exploit
http://www.osvdb.org/76712

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:appthemes:classipress:*:*:*:*:*:*:*:*

Версия до 3.1.4 (включая)

cpe:2.3:a:appthemes:classipress:3.0.5.2:*:*:*:*:*:*:*

cpe:2.3:a:appthemes:classipress:3.0.5.3:*:*:*:*:*:*:*

cpe:2.3:a:appthemes:classipress:3.1.3:*:*:*:*:*:*:*

cpe:2.3:a:appthemes:classipress:3.1.5:*:*:*:*:*:*:*

cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*

EPSS

Процентиль: 82%

0.01827

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-643q-98g3-qq46

github

около 3 лет назад