CVE-2014-100018

MEDIUM · 4.3 CVSS Gepubliceerd: 13-01-2015 CWE-79

Beschrijving

Cross-site scripting (XSS) vulnerability in the Unconfirmed plugin before 1.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in the unconfirmed page to wp-admin/network/users.php.

Vendors

Unconfirmed Project

Affected products

Unconfirmed

References

secunia.com
www.securityfocus.com
security.dxw.com
wordpress.org