Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
wpvulndbWpvulndbWPVDB-ID:405709DA-8EB7-4525-9F1E-850E4D291BAB
HistoryMay 04, 2020 - 12:00 a.m.

wpForo < 1.7.0 - Reflected Cross-Site Scripting (XSS) via langid Parameter

2020-05-0400:00:00
wpscan.com
6

EPSS

0.001

Percentile

37.3%

JSON

The plugin did not escape, validate or escape the ‘langid’ GET parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in admin

PoC

https://example.com/wp-admin/admin.php?page=wpforo-phrases&amp;ids;&amp;action;=-1&amp;langid;=">&phrase;_package=0&paged;=1&action2;=-1

Related

prion 1
cvelist 1
nvd 1
cve 1
wpexploit 1
prion
prion
Design/Logic Flaw
2020-06-15 14:15:00
cvelist
cvelist
CVE-2019-19111
2020-06-15 13:10:49
nvd
nvd
CVE-2019-19111
2020-06-15 14:15:09
cve
cve
CVE-2019-19111
2020-06-15 14:15:09
wpexploit
wpexploit
wpForo < 1.7.0 - Reflected Cross-Site Scripting (XSS) via langid Parameter
2020-05-04 00:00:00

EPSS

0.001

Percentile

37.3%

JSON
Related for WPVDB-ID:405709DA-8EB7-4525-9F1E-850E4D291BAB
prion1cvelist1nvd1cve1wpexploit1