CVE-2012-6506
MEDIUM
4.3
CVSS 2.0
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in zing.inc.php or (2) notes parameter in fws/pages-front/onecheckout.php.
Affected products and versions
- n/a n/a — Versions not specified
References
- plugins.trac.wordpress.org http://plugins.trac.wordpress.org/changeset?reponame=&old=537613%40zingiri-web-shop&new=537613%40zingiri-web-shop Exploit, Patch
- secunia.com http://secunia.com/advisories/48991 Vendor Advisory
- wordpress.org http://wordpress.org/extend/plugins/zingiri-web-shop/changelog/
- www.exploit-db.com http://www.exploit-db.com/exploits/18787 Exploit
- www.osvdb.org http://www.osvdb.org/81492
- www.osvdb.org http://www.osvdb.org/81493
- www.securityfocus.com http://www.securityfocus.com/bid/53278
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/75178
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/75179
- nvd.nist.gov Official NVD record