Cross-Site Scripting Vulnerability in WPGlobus Plugin for WordPress
CVE-2018-5365

4.8MEDIUM

Key Information:

Vendor

Wordpress
Status
WPglobus
Vendor
CVE Published:
12 January 2018

What is CVE-2018-5365?

The WPGlobus plugin version 1.9.6 for WordPress contains a Cross-Site Scripting (XSS) vulnerability in the 'wpglobus_option[selector_wp_list_pages][show_selector]' parameter when processed by wp-admin/options.php. This flaw allows attackers to inject malicious scripts, potentially compromising user sessions and data integrity. Site administrators should ensure they are using the latest versions of this plugin to mitigate risks associated with this vulnerability.

References

https://github.com/d4wner/Vulnerabilities-Report/blob/mas...
x_refsource_MISC
https://wpvulndb.com/vulnerabilities/9003
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.