PT-2017-7253 · WordPress · Resads

Published 2017-12-27 · Updated 2018-10-09 · CVE-2015-7667

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ResAds plugin versions prior to 1.0.2

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerabilities are located in the templates/admanagement/admanagement.php and templates/adspot/adspot.php files of the ResAds plugin for WordPress. The page parameter is used to inject the malicious script or HTML.

Recommendations For ResAds plugin versions prior to 1.0.2, update to version 1.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the templates/admanagement/admanagement.php and templates/adspot/adspot.php files to minimize the risk of exploitation. Avoid using the page parameter in the affected files until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-7667

Affected Products

Resads

References · 5

• https://wordpress.org/plugins/resads/#developers · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-7667 · Security Note
• https://wpvulndb.com/vulnerabilities/8204 · Note
• http://securityfocus.com/archive/1/536601/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7667 · Note