System Dashboard < 2.8.10 - XSS via Header Injection
28Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 5.4epss 0.8%
exploitation probability
0.8%top 46% of all CVEs
observed exploitation
nono source reports it
The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected products
Unknown · System Dashboard