PT-2015-5162 · WordPress · Wp Slimstat

Published 2015-01-21 · Updated 2015-01-23 · CVE-2015-1204

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WP Slimstat plugin versions prior to 3.9.2

Description A cross-site scripting (XSS) issue exists in the Save Filters functionality of the WP Slimstat plugin. This allows remote attackers to inject arbitrary web script or HTML via the fs[resource] parameter in the "wp-slim-view-2" page to "wp-admin/admin.php".

Recommendations For WP Slimstat plugin versions prior to 3.9.2, update to version 3.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Save Filters functionality until the update is applied. Avoid using the fs[resource] parameter in the affected page until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-1204

Affected Products

Wp Slimstat

References · 5

• 🔥 https://wpvulndb.com/vulnerabilities/7744 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-1204 · Security Note
• https://wordpress.org/plugins/wp-slimstat/changelog · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1204 · Note
• http://secunia.com/advisories/62034 · Note