CVE-2015-4063

Nuclei

WordPress Plugin NewStatPress 0.9.8 - Multiple Vulnerabilities

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2015-4063 has a selected CVSS score of 3.5; EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the where1 parameter in the nsp_search page to wp-admin/admin.php.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Proofs of concept

1

Catalogued exploits

ExploitDBWordPress Plugin NewStatPress 0.9.8 - Multiple VulnerabilitiesExploitDB exploitby Adrián M. F.Not analyzed1 file

linked to 2 vulnerabilities

ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryLOWNewStatPress <0.9.9 - Cross-Site ScriptingCVSS 3.5

WordPress NewStatPress plugin before 0.9.9 contains a cross-site scripting vulnerability in includes/nsp_search.php. The plugin allows remote authenticated users to inject arbitrary web script or HTML via the where1 parameter in the nsp_search page to wp-admin/admin.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.

Remediation

Update to plugin version 0.9.9 or latest.

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscve2015cvexsswordpresswp-pluginwpnewstatpresspacketstormnewstatpress_projectvulnauthenticated
CVSS vector: CVSS:2.0/AV:N/AC:M/Au:S/C:N/I:P/A:N
CPE: cpe:2.3:a:newstatpress_project:newstatpress:*:*:*:*:*:wordpress:*:*
https://packetstormsecurity.com/files/132038/ https://wordpress.org/plugins/newstatpress/ http://packetstormsecurity.com/files/132038/WordPress-NewStatPress-0.9.8-Cross-Site-Scripting-SQL-Injection.html https://nvd.nist.gov/vuln/detail/CVE-2015-4063 https://wordpress.org/plugins/newstatpress/changelog/

Source: ProjectDiscovery

References

5