PT-2023-10283 · WordPress · Icons For Features Plugin

Published 2023-04-30 · Updated 2024-05-17 · CVE-2015-10104

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Icons for Features Plugin version 1.0.0

Description A problematic issue has been found in the Icons for Features Plugin on WordPress, affecting some unknown functionality of the file classes/class-icons-for-features-admin.php. The manipulation of the redirect url argument leads to open redirect. The attack may be launched remotely. Upgrading to version 1.0.1 is able to address this issue.

Recommendations For Icons for Features Plugin version 1.0.0, upgrade to version 1.0.1 to address the issue. As a temporary workaround, consider restricting the manipulation of the redirect url argument to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2015-10104

Affected Products

Icons For Features Plugin

References · 6

• https://github.com/wp-plugins/icons-for-features/commit/63124c021ae24b68e56872530df26eb4268ad633 · Patch
• https://github.com/wp-plugins/icons-for-features/releases/tag/1.0.1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-10104 · Security Note
• https://vuldb.com/?ctiid.227756 · Note
• https://vuldb.com/?id.227756 · Note
• https://t.me/cvenotify/49916 · Telegram Post