Описание
The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.8 (исключая)
cpe:2.3:a:plugin-planet:prismatic:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 94%
0.13254
Средний
6.1 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-79
Связанные уязвимости
github
больше 3 лет назад
The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
EPSS
Процентиль: 94%
0.13254
Средний
6.1 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-79