Stored XSS in WebARX Plugin for WordPress by WebARX
CVE-2019-17213

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Webarx
Vendor
CVE Published:
6 October 2019

Summary

The WebARX Plugin version 1.3.0 for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious scripts. This could occur via the Uniform Resource Identifier (URI) or through the X-Forwarded-For HTTP header, enabling unauthenticated users to execute arbitrary JavaScript in the context of the victim's browser. Such exploitation can lead to session hijacking, data theft, and further unauthorized actions within the affected WordPress installations.

References

https://www.acunetix.com/vulnerabilities/web/wordpress-pl...
x_refsource_MISC
https://packetstormsecurity.com/files/149573/WordPress-We...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.