PT-2018-10674 · WordPress · Gameplan

Publicado 2018-05-30 · Atualizado 2018-07-13 · CVE-2018-11568

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GamePlan theme for WordPress versions prior to 1.5.13.2

Description The issue is related to insufficient input sanitization, allowing for Reflected XSS. This can be demonstrated through the s parameter. In some cases, the '<' and '>' characters are represented as '<' and '>'.

Recommendations For versions prior to 1.5.13.2, update to a version that includes the necessary input sanitization fixes to prevent Reflected XSS. As a temporary workaround, consider restricting user input to prevent the injection of malicious code.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-11568

Produtos afetados

Gameplan

Referências · 3

• 🔥 https://packetstormsecurity.com/files/143666/WordPress-GamePlan-Event-And-Gym-Fitness-Theme-1.5.13.2-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-11568 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-11568 · Aviso do Fabricante