WordPress Stock Ambiance Plugin Authenticated XSS Vulnerability

Vulnerability Overview Vulnerability Name: WordPress <= 4.9.8 - Authenticated (Contributor) Based Cross-Site Scripting via WordPress Stock Ambiance Vulnerability Type: Cross-Site Scripting (XSS) Vulnerability Description: This vulnerability allows authenticated Contributor-level users to execute cross-site scripting attacks via the WordPress Stock Ambiance plugin. Affected Scope Affected Versions: WordPress <= 4.9.8 Affected Plugin: WordPress Stock Ambiance Affected Users: Authenticated Contributor-level users Remediation Remediation Advice: Update WordPress to the latest version and update the WordPress Stock Ambiance plugin to the latest version. Temporary Mitigation Measures: Restrict the permissions of Contributor-level users to prevent them from uploading or editing content that may contain malicious scripts. POC Code Additional Information Vulnerability Score: 5.4 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Publication Date: 2018-10-10 Last Update Date: 2018-10-10 Related Resources Vulnerability Details: Vulnerability Details for WordPress - PDF Embedder, 3D PDF Flipbook, Google Reviews, YouTube Videos, Upload & Linked PDF documents Remediation Status: Fixed Notes Vulnerability Source: Wordfence Intelligence Vulnerability Type: Cross-Site Scripting (XSS) Summary This vulnerability allows authenticated Contributor-level users to execute cross-site scripting attacks via the WordPress Stock Ambiance plugin. It is recommended to update WordPress and the plugin to the latest versions and restrict the permissions of Contributor-level users to mitigate the risk.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Stock Ambiance Plugin Authenticated XSS Vulnerability

More from this source