CVE-2017-18556

MEDIUMNuclei

Google Analytics by BestWebSoft < 1.7.1 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2017-18556 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMGoogle Analytics by BestWebSoft < 1.7.1 - Cross-Site ScriptingCVSS 6.1

The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.

Impact

Authenticated attackers can execute arbitrary JavaScript in victims' browsers, potentially stealing session cookies, credentials, or performing actions on behalf of users.

Remediation

Fixed in version 1.7.1

WeaknessesCWE-79
Authorsluisfelipe146
Template tagscve2017cvewordpresswp-pluginxssbws-google-analyticswpscanauthenticatedbestwebsoftvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:bestwebsoft:google_analytics:*:*:*:*:*:wordpress:*:*
Shodan: http.html:/wp-content/plugins/bws-google-analytics/
FOFA: body=/wp-content/plugins/bws-google-analytics/
https://wpscan.com/vulnerability/efd816c3-90d4-40bf-850a-0e4c1a756694 https://nvd.nist.gov/vuln/detail/CVE-2017-18556 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18556 https://wordpress.org/plugins/bws-google-analytics/#developers

Source: ProjectDiscovery

References

2