CVE-2015-9312

MEDIUMNuclei

NewStatPress <=1.0.4 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2015-9312 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMNewStatPress <=1.0.4 - Cross-Site ScriptingCVSS 6.1

WordPress NewStatPress plugin through 1.0.4 contains a cross-site scripting vulnerability. The plugin utilizes, on lines 28 and 31 of the file "includes/nsp_search.php", several variables from the $_GET scope without sanitation. While WordPress automatically escapes quotes on this scope, the outputs on these lines are outside of quotes, and as such can be utilized to initiate a cross-site scripting attack.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the affected website, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Fixed in version 1.0.6

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscve2015cvexssauthenticatedwpnewstatpresswpscanwordpresswp-pluginnewstatpress_projectvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:newstatpress_project:newstatpress:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/46bf6c69-b612-4aee-965d-91f53f642054 https://g0blin.co.uk/g0blin-00057/ https://wordpress.org/plugins/newstatpress/#developers https://nvd.nist.gov/vuln/detail/CVE-2015-9312 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

2