Cross-Site Scripting Vulnerabilities in User Login History Plugin for WordPress
CVE-2017-15867

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
User-login-history
Vendor
CVE Published:
24 October 2017

What is CVE-2017-15867?

The User Login History plugin for WordPress prior to version 1.5.2 has multiple cross-site scripting vulnerabilities. These flaws allow attackers to exploit specific parameters, including date_from, date_to, user_id, username, country_name, browser, operating_system, and ip_address, in the admin area. By injecting malicious HTML or web scripts, attackers could compromise user sessions or perform actions on behalf of administrators without their consent.

References

https://github.com/faiyazalam/WordPress-plugin-user-login...
x_refsource_CONFIRM
https://wpvulndb.com/vulnerabilities/8939
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.