CVE-2016-10973

MEDIUMNuclei

Brafton WordPress Plugin < 3.4.8 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2016-10973 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMBrafton WordPress Plugin < 3.4.8 - Cross-Site ScriptingCVSS 6.1

The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Upgrade to the latest version of the Brafton WordPress Plugin (version 3.4.9 or higher) to mitigate this vulnerability.

WeaknessesCWE-79
AuthorsHarsh
Template tagscve2016cvewpscanwordpresswpwp-pluginxssbraftonauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:brafton:brafton:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/93568433-0b63-4ea7-bbac-4323d3ee0abd https://nvd.nist.gov/vuln/detail/CVE-2026-10973 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

3