Cross-Site Scripting Vulnerability in ForumPress WP Forum Server Plugin by WordPress
CVE-2012-6623

Currently unrated

Key Information:

Vendor

Wordpress
Status
Forumpress
Vendor
CVE Published:
16 January 2014

What is CVE-2012-6623?

The ForumPress WP Forum Server plugin for WordPress is susceptible to a Cross-Site Scripting (XSS) vulnerability. This issue arises from improper validation of the groupid parameter in the addforum action, allowing remote attackers to inject arbitrary web scripts or HTML. To mitigate the risk, users of versions prior to 1.7.5 are strongly advised to update their installations promptly.

References

https://plugins.trac.wordpress.org/changeset/572188
x_refsource_CONFIRM
http://wordpress.org/extend/plugins/forum-server/changelog/
x_refsource_CONFIRM
http://secunia.com/advisories/49167
third-party-advisoryx_refsource_SECUNIA

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.