CVE-2015-2218

EPSS 4.2%

Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) item[name] or (2) item[customcss] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or the itemid parameter in the (3) wonderplugin_audio_show_item or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/36086unverified exploitdbwww.exploit-db.com/exploits/36086unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://osvdb.org/show/osvdb/118510 http://osvdb.org/show/osvdb/118511 http://security.szurek.pl/wonderplugin-audio-player-20-blind-sql-injection-and-xss.html http://www.exploit-db.com/exploits/36086 http://www.securityfocus.com/bid/74851 http://www.wonderplugin.com/wordpress-audio-player/