CVE-2018-18069

MEDIUMNuclei

WordPress sitepress-multilingual-cms 3.6.3 - Cross-Site Scripting

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2018-18069 has a selected CVSS score of 6.1 (medium); EIP currently links 2 curated repository PoCs and 1 Nuclei template.

Description

process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
2
Nuclei templates
1

Proofs of concept

2

Curated repository PoCs

GitHubCVE-2018-18069Curated repository PoCby yubsy112Not analyzed1 file

Python · 931 B

GitHub
PoC details
GitHubCVE-2018-18069Curated repository PoCby 0xd3vil127Not analyzed1 file

Python · 931 B

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress sitepress-multilingual-cms 3.6.3 - Cross-Site ScriptingCVSS 6.1

WordPress plugin sitepress-multilingual-cms 3.6.3 is vulnerable to cross-site scripting in process_forms via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft or unauthorized actions.

Remediation

Update WordPress sitepress-multilingual-cms to the latest version to mitigate the XSS vulnerability.

WeaknessesCWE-79
Authorsnadino
Template tagscve2018cvewordpressxsspluginwpmlvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:wpml:wpml:*:*:*:*:*:wordpress:*:*
https://0x62626262.wordpress.com/2018/10/08/sitepress-multilingual-cms-plugin-unauthenticated-stored-xss/ https://nvd.nist.gov/vuln/detail/CVE-2018-18069 https://github.com/ARPSyndicate/kenzer-templates https://github.com/Elsfa7-110/kenzer-templates https://github.com/merlinepedra/nuclei-templates

Source: ProjectDiscovery

References

2