CVE-2008-1061

NUCLEI

Sniplets 1.1.2-1.2.2 - XSS

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to (a) warning.php, (b) notice.php, and (c) inset.php in view/sniplets/, and possibly (d) modules/execute.php; the (2) url parameter to (e) view/admin/submenu.php; and the (3) page parameter to (f) view/admin/pager.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by NBBN · textwebappsphp

https://www.exploit-db.com/exploits/5194

View Code ZIP pw:eip

Nuclei Templates (1)

WordPress Sniplets <=1.2.2 - Cross-Site Scripting

MEDIUMby dhiyaneshDK

References (6)

[Vendor Advisory] http://secunia.com/advisories/29099

[Exploit] http://www.securityfocus.com/bid/27985

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/40830

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/488734/100/0/threaded

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/5194

[Third Party Advisory] http://securityreason.com/securityalert/3706

Scores

EPSS 0.0016

EPSS Percentile 36.5%

Classification

CWE

CWE-79

Status draft

Affected Products (2)

wordpress/sniplets_plugin

wordpress/sniplets_plugin

Timeline

Published Feb 28, 2008

Tracked Since Feb 18, 2026