CVE-2014-100026

Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack plugin before 1.4.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: some of these details are obtained from third party information.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://osvdb.org/101807
http://secunia.com/advisories/55576
http://www.securityfocus.com/bid/64699
https://exchange.xforce.ibmcloud.com/vulnerabilities/90172
https://wordpress.org/plugins/aprils-super-functions-pack/changelog/	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:april\'s_super_functions_pack_project:april\'s_super_functions_pack:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2015-01-13 15:59

Updated : 2024-02-28 12:20

NVD link : CVE-2014-100026

Mitre link : CVE-2014-100026

CVE.ORG link : CVE-2014-100026

JSON object : View

Products Affected

april\'s_super_functions_pack_project

april\'s_super_functions_pack

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2014-100026", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-01-13T15:59:27.537", "references": [{"url": "http://osvdb.org/101807", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/55576", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/64699", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90172", "source": "cve@mitre.org"}, {"url": "https://wordpress.org/plugins/aprils-super-functions-pack/changelog/", "tags": ["Patch"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack plugin before 1.4.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: some of these details are obtained from third party information."}, {"lang": "es", "value": "Vulnerabilidad de XSS en readme.php en el plugin April's Super Functions Pack anterior a 1.4.8 para WordPress permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del par\u00e1metro page. NOTA: algunos de estos detalles se obtienen de informaci\u00f3n de terceras partes."}], "lastModified": "2017-09-08T01:29:02.057", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:april\\'s_super_functions_pack_project:april\\'s_super_functions_pack:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "62DA3E76-8D27-47CD-B9FB-149141D6898F", "versionEndIncluding": "1.4.7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}