Cross-Site Scripting Vulnerability in GD bbPress Attachments Plugin for WordPress
CVE-2015-5481

Currently unrated

Key Information:

Vendor
Wordpress
Status
Gd Bbpress Attachments
Vendor
CVE Published:
18 August 2015

Summary

The GD bbPress Attachments plugin for WordPress has a Cross-Site Scripting (XSS) vulnerability located in forms/panels.php. This flaw allows remote attackers to exploit the tab parameter via the gdbbpress_attachments page, leading to the ability to inject arbitrary web scripts or HTML. Affected versions include those prior to 2.3, posing significant risks for WordPress sites utilizing this plugin. Ensure you update to the latest version to mitigate this security issue.

References

https://wordpress.org/plugins/gd-bbpress-attachments/chan...
x_refsource_CONFIRM
https://wpvulndb.com/vulnerabilities/8088
x_refsource_MISC
https://security.dxw.com/advisories/reflected-xss-in-gd-b...
x_refsource_MISC

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.