WordPress CVEs

Description

Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter.

Affected WordPress components

• Disqus Comment System Plugin · disqus-comment-system
  Confirmed match Active
  Versions not specified
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• disqus disqus_comment_system — Up to and including 2.75
• disqus disqus_comment_system — Version 2.40
• disqus disqus_comment_system — Version 2.41
• disqus disqus_comment_system — Version 2.42
• disqus disqus_comment_system — Version 2.43
• disqus disqus_comment_system — Version 2.44
• disqus disqus_comment_system — Version 2.45
• disqus disqus_comment_system — Version 2.46
• disqus disqus_comment_system — Version 2.47
• disqus disqus_comment_system — Version 2.48
• disqus disqus_comment_system — Version 2.49
• disqus disqus_comment_system — Version 2.50
• disqus disqus_comment_system — Version 2.51
• disqus disqus_comment_system — Version 2.52
• disqus disqus_comment_system — Version 2.53
• disqus disqus_comment_system — Version 2.54
• disqus disqus_comment_system — Version 2.55
• disqus disqus_comment_system — Version 2.60
• disqus disqus_comment_system — Version 2.61
• disqus disqus_comment_system — Version 2.62
• disqus disqus_comment_system — Version 2.63
• disqus disqus_comment_system — Version 2.64
• disqus disqus_comment_system — Version 2.65
• disqus disqus_comment_system — Version 2.66
• disqus disqus_comment_system — Version 2.67
• disqus disqus_comment_system — Version 2.68
• disqus disqus_comment_system — Version 2.69
• disqus disqus_comment_system — Version 2.70
• disqus disqus_comment_system — Version 2.71
• disqus disqus_comment_system — Version 2.72
• disqus disqus_comment_system — Version 2.73
• disqus disqus_comment_system — Version 2.74

References

• packetstormsecurity.com http://packetstormsecurity.com/files/127847/WordPress-Disqus-2.7.5-CSRF-Cross-Site-Scripting.html
• seclists.org http://seclists.org/fulldisclosure/2014/Aug/35
• www.securityfocus.com http://www.securityfocus.com/bid/69205
• wordpress.org https://wordpress.org/plugins/disqus-comment-system/other_notes Patch
• www.nikcub.com https://www.nikcub.com/posts/multiple-vulnerabilities-in-disqus-wordpress-plugin Exploit
• nvd.nist.gov Official NVD record