PT-2019-14613 · WordPress · Insert-Php

Publicado 2019-09-13 · Atualizado 2019-09-16 · CVE-2019-16289

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions insert-php (aka Woody ad snippets) plugin versions prior to 2.2.8

Description The issue allows authenticated XSS via the winp item parameter.

Recommendations For versions prior to 2.2.8, update to version 2.2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the winp item parameter to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-16289

Produtos afetados

Insert-Php

Referências · 5

• 🔥 https://generaleg0x01.com/2019/09/13/xss-woody · Exploit
• https://wpvulndb.com/vulnerabilities/9880 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-16289 · Nota de Segurança
• https://wordpress.org/plugins/insert-php/#developers · Nota
• https://osv.dev/vulnerability/CVE-2019-16289 · Aviso do Fabricante