Smush < 3.9.9 - Admin+ Reflected Cross-Site Scripting

The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious configuration file

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

WordPress plugin Smush 跨站脚本漏洞

WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Smush 3.9.9之前版本存在跨站脚本漏洞，该漏洞源于不会对其进行清理和转义。攻击者利用该漏洞执行跨站点脚本攻击。

N/A

N/A