WordPress Plugin Feature Slideshow 1.0.6 - src Cross-Site Scripting

2011-01-24T00:00:00
ID EXPLOITPACK:E38C68256246DB8C3FB1C7E790CCBC37
Type exploitpack
Reporter AutoSec Tools
Modified 2011-01-24T00:00:00

Description

WordPress Plugin Feature Slideshow 1.0.6 - src Cross-Site Scripting

                                        
                                            source: https://www.securityfocus.com/bid/46004/info

The Feature Slideshow Plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Feature Slideshow Plugin 1.0.6 is vulnerable; other versions may also be affected.

http://www.example.com/wordpress/wp-content/plugins/feature-slideshow/timthumb.php?src=<script>alert(0)</script>