Cross-Site Scripting in AnyComment Plugin for WordPress
CVE-2018-21001

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Anycomment
Vendor
CVE Published:
27 August 2019

What is CVE-2018-21001?

The AnyComment plugin for WordPress, prior to version 0.0.33, contains a vulnerability that allows attackers to execute malicious scripts in the context of a user’s session. This could lead to unauthorized actions or data exposure when users interact with affected components of the plugin.

References

https://wordpress.org/plugins/anycomment/#developers
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.