CVE-2011-5257

2022-10-0316:15:11

CWE-79

[email protected]

web.nvd.nist.gov

6147

cve-2011-5257

xss

classipress theme

wordpress

nvd

cross-site scripting

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.3%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the Classipress theme before 3.1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) twitter_id parameter related to the Twitter widget and (2) facebook_id parameter related to the Facebook widget.

Affected configurations

NVD

Node

appthemesclassipressRange≤3.1.4

appthemesclassipressMatch3.0.5.2

appthemesclassipressMatch3.0.5.3

appthemesclassipressMatch3.1.3

appthemesclassipressMatch3.1.5

AND

wordpresswordpressMatch-

CPENameOperatorVersion
appthemes:classipressappthemes classipressle3.1.4
appthemes:classipressappthemes classipresseq3.0.5.2
appthemes:classipressappthemes classipresseq3.0.5.3
appthemes:classipressappthemes classipresseq3.1.3
appthemes:classipressappthemes classipresseq3.1.5

CPE	Name	Operator	Version
appthemes:classipress	appthemes classipress	le	3.1.4
appthemes:classipress	appthemes classipress	eq	3.0.5.2
appthemes:classipress	appthemes classipress	eq	3.0.5.3
appthemes:classipress	appthemes classipress	eq	3.1.3
appthemes:classipress	appthemes classipress	eq	3.1.5