Cross-Site Scripting Vulnerability in Compfight Plugin for WordPress
CVE-2014-8622

Currently unrated

Key Information:

Vendor

Wordpress
Status
Compfight
Vendor
CVE Published:
5 November 2014

What is CVE-2014-8622?

The Compfight plugin version 1.4 for WordPress contains a cross-site scripting (XSS) vulnerability that allows remote authenticated users to inject arbitrary web scripts or HTML via the 'search-value' parameter of the compfight-search.php file. This flaw can be exploited, leading to unauthorized actions being performed on behalf of users, compromising the security of affected WordPress installations.

References

http://wordpress.org/plugins/compfight/changelog/
x_refsource_CONFIRM
http://packetstormsecurity.com/files/127430/WordPress-Com...
x_refsource_MISC
http://downloads.wordpress.org/plugin/compfight.1.5.zip
x_refsource_CONFIRM

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.