The latest Cross-site scripting vulnerabilities in WordPress plugins

Five Cross-site scripting vulnerabilities in WordPress plugins: Profile Builder, Photo Gallery, EWWW Image Optimizer, Contact Form DB, and Google Calendar Events.

1. Cross-site scripting in WordPress Profile Builder Plugin

Danger: Low

Availability Corrections: Yes

Number of vulnerabilities: 1

CVSSv2 Rating: (AV: N / AC: L / Au: N / C: N / I: P / A: N / E: U / RL: O / RC: C) = Base: 5 / Temporal: 3.7

Vector operation: Remote

Impact: Cross-site scripting (XSS attack)

Affected products: WordPress Profile Builder Plugin 1.x

Affected versions: WordPress Profile Builder version to 1.1.66

Description:

The vulnerability allows a remote user produce XSS attack.

The vulnerability is caused due to insufficient processing of the input data associated with forms. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Solution: Install the latest version 1.1.66 from the manufacturer.

Link: https://wordpress.org/plugins/profile-builder/changelog/

2. Cross-site scripting in WordPress Photo Gallery Plugin

Danger: Low

Availability Corrections: Yes

Number of vulnerabilities: 1

CVSSv2 Rating: (AV: N / AC: L / Au: N / C: N / I: P / A: N / E: U / RL: O / RC: C) = Base: 5 / Temporal: 3.7

CVE ID: CVE-2014-6315

Vector operation: Remote

Impact: Cross-site scripting (XSS attack)

Affected products: WordPress PICA Photo Gallery Plugin 1.x

Affected: WordPress Photo Gallery version to 1.1.31

Description:

The vulnerability make possible for the remote user to produce XSS attack.

The vulnerability is caused due to insufficient input data processing in the GET parameter “callback”, “dir” and “extensions” in the script wp-admin / admin-ajax.php. A remote user can with the help of a specially formed links to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Solution: Install the latest version 1.1.31 from the manufacturer.

Link: https://www.htbridge.com/advisory/HTB23232

3. Cross-site scripting in WordPress EWWW Image Optimizer

Danger: Low

Availability Corrections: Yes

Number of vulnerabilities: 1

CVSSv2 Rating: (AV: N / AC: L / Au: N / C: N / I: P / A: N / E: U / RL: O / RC: C) = Base: 5 / Temporal: 3.7

CVE ID: CVE-2014-6243

Vector operation: Remote

Impact: Cross-site scripting (XSS attack)

Affected products: WordPress EWWW Image Optimizer 2.x

Affected versions: WordPress EWWW Image Optimizer 2.0.1, possibly earlier versions

Description:

The vulnerability make possible for the remote user to produce XSS attack.

The vulnerability is caused due to insufficient processing of the input data in HTTP GET parameter “page” in the script /wp-admin/options-general.php. This can be exploited via a specially crafted link to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Note: Successful exploitation of this vulnerability requires that a function JavaScript “alert ()” displayed the manager’s cookies.

Solution: Install the latest version 2.0.2 from the manufacturer.

Links: https://www.htbridge.com/advisory/HTB23234

4. Cross-site scripting in WordPress Contact Form DB

Danger: Low

Availability Corrections: Yes

Number of vulnerabilities: 1

CVSSv2 Rating: (AV: N / AC: L / Au: N / C: N / I: P / A: N / E: U / RL: O / RC: C) = Base: 5 / Temporal: 3.7

CVE ID: CVE-2014-7139

Vector operation: Remote

Impact: Cross-site scripting

Affected products: WordPress Contact Form DB 2.x

Affected versions: WordPress Contact Form DB 2.8.13, possibly earlier versions

Description:

The vulnerability allows a remote user produce XSS attack.

The vulnerability is caused due to insufficient processing of the input data in HTTP GET parameter “form” in the script /wp-admin/admin.php, as well as HTTP GET parameter “enc” in the script /wp-admin/admin.php. This can be exploited via a specially crafted link to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Solution: Install the latest version 2.8.16 from the manufacturer.

Link: https://www.htbridge.com/advisory/HTB23233

5. Cross-site scripting in WordPress Google Calendar Events

Danger: Low

Availability Corrections: Yes

Number of vulnerabilities: 1

CVSSv2 Rating: (AV: N / AC: L / Au: N / C: N / I: P / A: N / E: U / RL: O / RC: C) = Base: 5 / Temporal: 3.7

CVE ID: CVE-2014-7138

Vector operation: Remote

Impact: Cross-site scripting

Affected products: WordPress Google Calendar Events 2.x

Affected versions: WordPress Google Calendar Events 2.0.1, possibly earlier versions

Description:

The vulnerability allows a remote user to XXS-attack.

The vulnerability is caused due to insufficient processing of the input data in HTTP GET parameter “gce_feed_ids” in the script /wp-admin/admin-ajax.php. This can be exploited via a specially crafted link to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Solution: Install the latest version 2.0.4 from the manufacturer.

Links: https://www.htbridge.com/advisory/HTB23235

Manufacturers URLs:

WordPress Contact Form DB

WordPress Profile Builder

WordPress EWWW Image Optimizer

WordPress Google Calendar Events

WordPress Photo Gallery