CVE-2014-8087

Опубликовано: 16 окт. 2017

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in the post highlights plugin before 2.6.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the txt parameter in a headline action to ajax/ph_save.php.

Ссылки

https://g0blin.co.uk/cve-2014-8087/
Exploit
Issue Tracking
Third Party Advisory
https://wordpress.org/plugins/post-highlights/#developers
Release Notes
Third Party Advisory
https://wpvulndb.com/vulnerabilities/8240
Third Party Advisory
VDB Entry
https://g0blin.co.uk/cve-2014-8087/
Exploit
Issue Tracking
Third Party Advisory
https://wordpress.org/plugins/post-highlights/#developers
Release Notes
Third Party Advisory
https://wpvulndb.com/vulnerabilities/8240
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:post_highlights_projects:post_highlights:*:*:*:*:*:wordpress:*:*

Версия до 2.6 (включая)

EPSS

Процентиль: 54%

0.00311

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-m6h8-3qmh-9pqc