CVE-2018-5316

MEDIUMNuclei

WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2018-5316 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site ScriptingCVSS 6.1

WordPress SagePay Server Gateway for WooCommerce before 1.0.9 is vulnerable to cross-site scripting via the includes/pages/redirect.php page parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Update to the latest version of the WordPress SagePay Server Gateway for WooCommerce plugin (1.0.9 or higher) to mitigate this vulnerability.

WeaknessesCWE-79
Authorsdaffainfo
Template tagscve2018cvewordpressxsswp-pluginwpwoocommercepacketstormpatsatechvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:patsatech:sagepay_server_gateway_for_woocommerce:*:*:*:*:*:wordpress:*:*
https://wordpress.org/support/topic/sagepay-server-gateway-for-woocommerce-1-0-7-cross-site-scripting/#post-9792337 https://wordpress.org/plugins/sagepay-server-gateway-for-woocommerce/#developers https://packetstormsecurity.com/files/145459/WordPress-Sagepay-Server-Gateway-For-WooCommerce-1.0.7-XSS.html https://nvd.nist.gov/vuln/detail/CVE-2018-5316 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

4