Lucene search

CVE-2018-11366

🗓️ 22 May 2018 13:00:29Reported by mitreType

cve🔗 web.nvd.nist.gov👁 38 Views🌐 WEB

Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS) logging mishandling

5 of 5AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 8
RedhatCVE	CVE-2018-11366	22 May 202502:47	–	redhatcve
NVD	CVE-2018-11366	22 May 201813:29	–	nvd
wpexploit	Loginizer 1.3.8-1.3.9 - Unauthenticated Stored Cross-Site Scripting (XSS)	22 May 201800:00	–	wpexploit
Prion	Cross site scripting	22 May 201813:29	–	prion
Patchstack	WordPress Loginizer plugin 1.3.8-1.3.9 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability	30 May 201800:00	–	patchstack
WPVulnDB	Loginizer 1.3.8-1.3.9 - Unauthenticated Stored Cross-Site Scripting (XSS)	22 May 201800:00	–	wpvulndb
OpenVAS	WordPress Loginizer Plugin 1.3.8 - 1.3.9 Stored XSS Vulnerability	24 May 201800:00	–	openvas
Cvelist	CVE-2018-11366	22 May 201813:00	–	cvelist

Nvd

Node

loginizer loginizerMatch1.3.8wordpress

loginizer loginizerMatch1.3.9wordpress

Source	Link
wpvulndb	www.wpvulndb.com/vulnerabilities/9088
plugins	www.plugins.trac.wordpress.org/changeset/1878502/loginizer
wordpress	www.wordpress.org/plugins/loginizer/
blog	www.blog.dewhurstsecurity.com/2018/05/22/loginizer-wordpress-plugin-xss-vulnerability.html

Parameter	Position	Path	Description	CWE
log	request body	/wp-login.php	The wp-login.php endpoint is vulnerable to Stored XSS due to mishandled logging functionality when malicious JavaScript is injected via a specific request.	CWE-79
pwd	request body	/wp-login.php	The wp-login.php endpoint is vulnerable to Stored XSS due to mishandled logging functionality when malicious JavaScript is injected via a specific request.	CWE-79
wp-submit	request body	/wp-login.php	The wp-login.php endpoint is vulnerable to Stored XSS due to mishandled logging functionality when malicious JavaScript is injected via a specific request.	CWE-79
redirect_to	request body	/wp-login.php	The wp-login.php endpoint is vulnerable to Stored XSS due to mishandled logging functionality when malicious JavaScript is injected via a specific request.	CWE-79
testcookie	request body	/wp-login.php	The wp-login.php endpoint is vulnerable to Stored XSS due to mishandled logging functionality when malicious JavaScript is injected via a specific request.	CWE-79
a	request body	/wp-login.php	The wp-login.php endpoint is vulnerable to Stored XSS due to mishandled logging functionality when malicious JavaScript is injected via a specific request.	CWE-79

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

22 May 2018 13:29Current

5.8Medium risk

Vulners AI Score5.8

CVSS24.3

CVSS36.1

EPSS0.00585

CWE-79