CVE-2016-1000142

MEDIUMNuclei

WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2016-1000142 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Reflected XSS in wordpress plugin parsi-font v4.2.5

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress MW Font Changer <=4.2.5 - Cross-Site ScriptingCVSS 6.1

WordPress MW Font Changer plugin 4.2.5 and before contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Allows remote attackers to execute arbitrary script or HTML code in the context of the affected site, potentially leading to session hijacking, defacement, or data theft.

Remediation

Update to the latest version of the WordPress MW Font Changer plugin (4.2.5) or remove the plugin if it is not necessary.

WeaknessesCWE-79
Authorsdaffainfo
Template tagscve2016cvewordpresswp-pluginxsswpscanparsi-font_projectvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:parsi-font_project:parsi-font:4.2.5:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/4ff5d65a-ba61-439d-ab7f-745a0648fccc http://www.vapidlabs.com/wp/wp_advisory.php?v=435 https://wordpress.org/plugins/parsi-font https://nvd.nist.gov/vuln/detail/CVE-2016-1000142 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

4