PT-2020-9402 · WordPress · Simple Link Directory

Published 2020-03-20 · Updated 2020-03-24 · CVE-2019-13463

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Simple Link Directory plugin versions prior to 7.3.5

Description: The issue allows remote attackers to inject arbitrary web script or HTML. This is because the esc html function is not called for the echo get the title() or echo $term->name statements in the qcopd-shortcode-generator.php file.

Recommendations: For versions prior to 7.3.5, update to version 7.3.5 or later to resolve the issue. As a temporary workaround, consider modifying the qcopd-shortcode-generator.php file to call esc html for the echo get the title() and echo $term->name statements to prevent code injection.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-13463

Affected Products

Simple Link Directory

References · 5

• https://osv.dev/vulnerability/CVE-2019-13463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13463 · Security Note
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fsimple-link-directory&old=2111131&new_path=%2Fsimple-link-directory&new=2111132&sfp_email=&sfph_mail= · Patch
• https://t.me/cvenotify/1971 · Telegram Post
• https://wordpress.org/plugins/simple-link-directory/#developers · Note