Cross-Site Scripting Vulnerabilities in Mingle Forum Plugin for WordPress
CVE-2013-0734

Currently unrated

Key Information:

Vendor
Wordpress
Status
Mingle-forum
Vendor
CVE Published:
28 March 2014

Summary

The Mingle Forum plugin for WordPress is susceptible to multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web scripts or HTML code. These vulnerabilities can be exploited through the 'search_words' parameter in a search action directed at wpf.class.php, and the 'togroupusers' parameter during an 'add_user_togroup' action in fs-admin/fs-admin.php.

References

http://secunia.com/secunia_research/2013-3
x_refsource_MISC
http://secunia.com/advisories/52167
third-party-advisoryx_refsource_SECUNIA
http://osvdb.org/90433
vdb-entryx_refsource_OSVDB

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.