Cross-Site Scripting Vulnerabilities in WP Symposium Plugin for WordPress
CVE-2015-9414

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
WP-symposium
Vendor
CVE Published:
26 September 2019

Summary

The WP Symposium plugin, specifically version 15.8.1 for WordPress, is susceptible to a cross-site scripting (XSS) vulnerability. This flaw arises from improper handling of the 'size' parameter in the get_album_item.php file, which can be exploited by malicious users to inject arbitrary script code. Exploiting this vulnerability may lead to unauthorized actions being performed on behalf of legitimate users and exposure of sensitive information.

References

https://wpvulndb.com/vulnerabilities/8175
x_refsource_MISC
https://wordpress.org/plugins/wp-symposium/#developers
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.