PT-2008-2243 · WordPress · Dmsguestbook

Published 2008-02-06 · Updated 2023-08-02 · CVE-2008-0618

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions DMSGuestbook plugin for WordPress versions 1.7.0 and 1.8.0

Description The issue allows remote attackers to inject arbitrary web script or HTML via the gbname, gbemail, gburl, and gbmsg parameters to unspecified programs, potentially leading to cross-site scripting (XSS) attacks.

Recommendations For DMSGuestbook plugin for WordPress version 1.7.0, update to a version that fixes the XSS vulnerabilities. For DMSGuestbook plugin for WordPress version 1.8.0, update to a version that fixes the XSS vulnerabilities. As a temporary workaround, consider restricting the use of the gbname, gbemail, gburl, and gbmsg parameters until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-0618

Affected Products

Dmsguestbook

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2008-0618 · Security Note
• http://secunia.com/advisories/28759 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0618 · Note