WordPress CVEs

Description

Cross-site scripting (XSS) vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in an edit action in the pods page to wp-admin/admin.php.

Affected WordPress components

• Pods – Custom Content Types and Fields Plugin · pods
  Confirmed match Active
  Up to and including 2.4.3
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• podsfoundation pods — Up to and including 2.4.3

References

• packetstormsecurity.com http://packetstormsecurity.com/files/129890/WordPress-Pods-2.4.3-CSRF-Cross-Site-Scripting.html Exploit
• seclists.org http://seclists.org/fulldisclosure/2015/Jan/26 Exploit
• www.securityfocus.com http://www.securityfocus.com/archive/1/534437/100/0/threaded
• www.securityfocus.com http://www.securityfocus.com/bid/71995
• nvd.nist.gov Official NVD record