Описание
The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page to the comment section
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.15.6 (включая)
cpe:2.3:a:obg:ark_wysiwyg_comment_editor:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 45%
0.00222
Низкий
5.3 Medium
CVSS3
Дефекты
CWE-74
Связанные уязвимости
CVSS3: 5.3
github
около 2 лет назад
The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page to the comment section
EPSS
Процентиль: 45%
0.00222
Низкий
5.3 Medium
CVSS3
Дефекты
CWE-74