CVE-2020-7107

MEDIUMNuclei

WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2020-7107 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Ultimate FAQ <1.8.30 - Cross-Site ScriptingCVSS 6.1

WordPress Ultimate FAQ plugin before 1.8.30 is susceptible to cross-site scripting via Display_FAQ to Shortcodes/DisplayFAQs.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could lead to the execution of arbitrary script code in the context of the affected website, potentially allowing an attacker to steal sensitive information or perform unauthorized actions.

Remediation

Fixed in version 1.8.30.

WeaknessesCWE-79
Authorstheamanrawat
Template tagscvecve2020ultimate-faqswpscanxsswordpresswp-pluginwpetoilewebdesignvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:etoilewebdesign:ultimate_faq:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/5e1cefd5-5369-44bd-aef7-2a382c8d8e33 https://wordpress.org/plugins/ultimate-faqs/ https://plugins.trac.wordpress.org/changeset/2222959/ultimate-faqs/tags/1.8.30/Shortcodes/DisplayFAQs.php https://nvd.nist.gov/vuln/detail/CVE-2020-7107 https://wordpress.org/plugins/ultimate-faqs/#developers

Source: ProjectDiscovery

References

4