CVE-2016-10993

MEDIUMNuclei

ScoreMe Theme - Cross-Site Scripting

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2016-10993 has a selected CVSS score of 5.4 (medium); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

Proofs of concept

1

Repository PoCs

GitHub0xc4t/CVE-2016-10993Repository PoCby 0xc4t1Not analyzed1 file

472 B

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMScoreMe Theme - Cross-Site ScriptingCVSS 5.4

WordPress ScoreMe theme through 2016-04-01 contains a reflected cross-site scripting vulnerability via the s parameter which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Apply the latest security patch or update to the ScoreMe Theme to fix the XSS vulnerability.

WeaknessesCWE-79
Authorsdaffainfo
Template tagscve2016cvewordpresswp-themexssscoreme_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:scoreme_project:scoreme:*:*:*:*:*:wordpress:*:*
https://www.vulnerability-lab.com/get_content.php?id=1808 https://wpvulndb.com/vulnerabilities/8431 https://nvd.nist.gov/vuln/detail/CVE-2016-10993 https://github.com/0xkucing/CVE-2016-10993 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

3