CVE-2017-18598

MEDIUMNuclei

WordPress Qards - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2017-18598 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Qards - Cross-Site ScriptingCVSS 6.1

WordPress Qards through 2017-10-11 contains a cross-site scripting vulnerability via a remote document specified in the URL parameter to html2canvasproxy.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential theft of sensitive information or unauthorized actions.

Remediation

Update to the latest version of the WordPress Qards plugin, which includes a fix for this vulnerability.

WeaknessesCWE-79
Authorspussycat0x
Template tagscve2017cvewp-pluginoastwpscanwordpressssrfxssdesignmodovuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:designmodo:qards:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/8934 https://wpscan.com/vulnerability/454a0ce3-ecfe-47fc-a282-5caa51370645 https://wpvulndb.com/vulnerabilities/8934 https://nvd.nist.gov/vuln/detail/CVE-2017-18598 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

2