Cross-Site Scripting in WPGlobus Plugin for WordPress
CVE-2018-5363

4.8MEDIUM

Key Information:

Vendor
Wordpress
Status
WPglobus
Vendor
CVE Published:
12 January 2018

Summary

The WPGlobus plugin version 1.9.6 for WordPress is susceptible to a Cross-Site Scripting (XSS) attack. The vulnerability arises from insufficient input validation for the parameters wpglobus_option[enabled_languages][en] and wpglobus_option[enabled_languages][fr] in the wp-admin/options.php file. Attackers can exploit this flaw by injecting malicious scripts, which can be executed in the context of the victim's browser, leading to unauthorized actions and potentially compromising sensitive data.

References

https://github.com/d4wner/Vulnerabilities-Report/blob/mas...
x_refsource_MISC
https://wpvulndb.com/vulnerabilities/9003
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.