Cross Site Scripting Vulnerability in GamerZ WP-PostRatings Could Lead to Remote Code Execution
CVE-2011-10006

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
WP-postratings
Vendor
CVE Published:
8 April 2024

What is CVE-2011-10006?

A cross-site scripting vulnerability exists in the GamerZ WP-PostRatings plugin prior to version 1.65. The flaw resides in the wp-postratings.php file, allowing attackers to manipulate content to execute script code in the context of the user's browser session. This vulnerability can be exploited remotely, making it imperative for users of affected versions to promptly upgrade to version 1.65 to alleviate potential security risks associated with this issue.

Affected Version(s)

WP-PostRatings 1.0

WP-PostRatings 1.1

WP-PostRatings 1.2

References

https://vuldb.com/?id.259629
vdb-entry
https://vuldb.com/?ctiid.259629
signaturepermissions-required
https://github.com/wp-plugins/wp-postratings/commit/dcc68...
patch

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

VulDB GitHub Commit Analyzer
.