CVE-2015-7666

Опубликовано: 27 дек. 2017

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the cal parameter.

Ссылки

http://www.securityfocus.com/archive/1/536602/100/0/threaded
Third Party Advisory
VDB Entry
https://plugins.trac.wordpress.org/changeset/1254452/payment-form-for-paypal-pro
Third Party Advisory
https://wordpress.org/plugins/payment-form-for-paypal-pro/#developers
Release Notes
Third Party Advisory
https://wpvulndb.com/vulnerabilities/8210
Third Party Advisory
Vendor Advisory
http://www.securityfocus.com/archive/1/536602/100/0/threaded
Third Party Advisory
VDB Entry
https://plugins.trac.wordpress.org/changeset/1254452/payment-form-for-paypal-pro
Third Party Advisory
https://wordpress.org/plugins/payment-form-for-paypal-pro/#developers
Release Notes
Third Party Advisory
https://wpvulndb.com/vulnerabilities/8210
Third Party Advisory
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:codepeople:payment_form_for_paypal_pro:*:*:*:*:*:wordpress:*:*

Версия до 1.0.1 (включая)

EPSS

Процентиль: 68%

0.00587

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-ffwp-2g6v-3x2g