PT-2019-7431 · WordPress · Incoming-Links Plugin

Deconf · Published 2019-10-10 · Updated 2019-10-15 · CVE-2015-9472

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions incoming-links plugin versions prior to 0.9.10b for WordPress

Description The issue allows for XSS via the Referer HTTP header in the referrers.php file.

Recommendations For versions prior to 0.9.10b, update to version 0.9.10b or later to resolve the issue. As a temporary workaround, consider restricting access to the referrers.php file until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-9472

Affected Products

Incoming-Links Plugin

References · 6

• https://plugins.trac.wordpress.org/changeset/1080044/incoming-links · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-9472 · Security Note
• https://wordpress.org/plugins/incoming-links/#developers · Note
• https://t.me/cibsecurity/7344 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9472 · Note
• https://wpvulndb.com/vulnerabilities/8015 · Note