PT-2018-6608 · Unknown · Z-Url Preview

Published 2018-01-01 · Updated 2018-01-11 · CVE-2017-18012

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Z-URL Preview plugin version 1.6.1

Description: The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved through the url parameter in the class.zlinkpreview.php file.

Recommendations: For Z-URL Preview plugin version 1.6.1, consider updating to a newer version that addresses this issue, if available. As a temporary workaround, restrict access to the class.zlinkpreview.php file to minimize the risk of exploitation. Avoid using the url parameter in the affected file until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-18012

Affected Products

Z-Url Preview

References · 7

• 🔥 https://wordpress.org/support/topic/z-url-preview-1-6-1-cross-site-scripting · Exploit
• 🔥 https://packetstormsecurity.com/files/145218/WordPress-Z-URL-Preview-1.6.1-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-18012 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18012 · Security Note
• https://plugins.svn.wordpress.org/z-url-preview/trunk/readme.txt · Vendor Advisory
• https://wpvulndb.com/vulnerabilities/8990 · Note
• https://wordpress.org/plugins/z-url-preview/#developers · Note