WordPress CVEs

Description

Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the whoisval parameter on the WordfenceWhois page to wp-admin/admin.php.

Affected WordPress components

• Wordfence Security – Firewall, Malware Scan, and Login Security Plugin · wordfence
  Confirmed match Active
  Versions not specified
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• wordfence_security_project wordfence_security — Version 5.0.1
• wordfence_security_project wordfence_security — Version 5.0.2
• wordfence_security_project wordfence_security — Version 5.0.3
• wordfence_security_project wordfence_security — Version 5.0.4
• wordfence_security_project wordfence_security — Version 5.0.5
• wordfence_security_project wordfence_security — Version 5.0.6
• wordfence_security_project wordfence_security — Version 5.0.7
• wordfence_security_project wordfence_security — Version 5.0.8
• wordfence_security_project wordfence_security — Version 5.0.9
• wordfence_security_project wordfence_security — Version 5.1.1
• wordfence_security_project wordfence_security — Version 5.1.2

References

• hacktivity.websecgeeks.com http://hacktivity.websecgeeks.com/word-press-firewall-plugin-xss/
• www.securityfocus.com http://www.securityfocus.com/archive/1/533907/100/0/threaded
• www.securityfocus.com http://www.securityfocus.com/bid/70911
• www.securityfocus.com http://www.securityfocus.com/bid/70915 Exploit
• www.wordfence.com http://www.wordfence.com/blog/2014/06/security-fix-wordfence-5-1-4/ Vendor Advisory
• wordpress.org https://wordpress.org/plugins/wordfence/changelog/ Patch, Vendor Advisory
• nvd.nist.gov Official NVD record