WordPress CVEs

Description

Multiple cross-site scripting (XSS) vulnerabilities in organizer/page/users.php in the Organizer plugin 1.2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) delete_id parameter or (2) extension parameter in an "Update Setting" action to wp-admin/admin.php.

Affected WordPress components

• organizer Plugin · organizer
  Confirmed match Homeless
  Up to and including 1.2.1
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• organizer_project organizer — Up to and including 1.2.1

References

• packetstormsecurity.org http://packetstormsecurity.org/files/112086/WordPress-Organizer-1.2.1-Cross-Site-Scripting-Path-Disclosure.html Exploit, Third Party Advisory, VDB Entry
• websecurity.com.ua http://websecurity.com.ua/5782 Exploit, Third Party Advisory
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/75105 Third Party Advisory, VDB Entry
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/75106 Third Party Advisory, VDB Entry
• nvd.nist.gov Official NVD record