CVE-2013-6281

Nuclei

WordPress Spreadsheet - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2013-6281 has a selected CVSS score of 4.3; EIP currently links 1 Nuclei template.

Description

Cross-site scripting (XSS) vulnerability in codebase/spreadsheet.php in the Spreadsheet (dhtmlxSpreadsheet) plugin 2.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "page" parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Spreadsheet - Cross-Site ScriptingCVSS 4.3

WordPress Spreadsheet plugin contains a reflected cross-site scripting vulnerability in /dhtmlxspreadsheet/codebase/spreadsheet.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected WordPress site, leading to potential data theft, session hijacking, or defacement.

Remediation

Update the WordPress Spreadsheet plugin to the latest version, which includes proper input sanitization to mitigate the XSS vulnerability.

WeaknessesCWE-79
Authorsrandom-robbie
Template tagscve2013cvewpwpscanwordpressxsswp-plugindhtmlxvuln
CVSS vector: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N
CPE: cpe:2.3:a:dhtmlx:dhtmlxspreadsheet:2.0:-:*:*:*:wordpress:*:*
Google: inurl:/wp-content/plugins/dhtmlxspreadsheet
https://wpscan.com/vulnerability/49785932-f4e0-4aaa-a86c-4017890227bf https://wordpress.org/plugins/dhtmlxspreadsheet/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6281 https://nvd.nist.gov/vuln/detail/CVE-2013-6281 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

4