Cross-Site Scripting Vulnerability in Nextend Facebook Connect Plugin for WordPress

CVE-2014-8800

What is CVE-2014-8800?

The Nextend Facebook Connect plugin for WordPress has a cross-site scripting vulnerability that allows remote attackers to inject arbitrary web scripts or HTML. This vulnerability exists in the nextend-facebook-settings.php file, where the fb_login_button parameter is improperly handled during the newfb_update_options action. Consequently, an attacker could exploit this weakness to execute malicious scripts in the context of the affected user, potentially leading to data theft, session hijacking, or other forms of exploitation.

References