WordPress U-Design Theme 2.7.9 Cross Site Scripting Vulnerability

2015-10-06T00:00:00
ID 1337DAY-ID-24373
Type zdt
Reporter K3n4ng
Modified 2015-10-06T00:00:00

Description

WordPress U-Design theme versions 2.3.0 through 2.7.9 suffer from a cross site scripting vulnerability.

                                        
                                            u-desing is a wordpress theme prone to DOM XSS vulnerability.

Vendor url:
http://themeforest.net/item/udesign-responsive-wordpress-theme/253220

versions between 2.7.9 – (Updated: 08.05.2015) and 2.3.0 – (Updated:
04.02.2014 - there are 40 of them) are vulnerable to DOM XSS which can be
exploited by adding #<svg onload=alert(1)> to the end of the url.

Vendor already patched the vulnerability on higher versions, but there are
still a lot of people/companies are using vulnerable ones.

Dork: inurl:/wp-theme/u-design/
You can check the version from: /wp-content/themes/u-design/style.css
CVE Reference: CVE-2015-7357
Author: @K3n4nG

#  0day.today [2018-04-02]  #