medium4.3
CVE-2012-1068
Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers…
Impact
Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mg12 | Wp-Recentcomments | through 2.0.7 Versions 1.8, 1.8.1, 1.8.2, 2.0, 2.0.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://plugins.trac.wordpress.org/changeset/416723/wp-recentcomments/trunk/core.php?old=316325&old_path=wp-recentcomments%2Ftrunk%2Fcore.php
- http://secunia.com/advisories/46141
- http://wordpress.org/extend/plugins/wp-recentcomments/changelog/
- http://www.osvdb.org/75635
- http://www.securityfocus.com/bid/49734
- https://exchange.xforce.ibmcloud.com/vulnerabilities/70003
- http://plugins.trac.wordpress.org/changeset/416723/wp-recentcomments/trunk/core.php?old=316325&old_path=wp-recentcomments%2Ftrunk%2Fcore.php
- http://secunia.com/advisories/46141
- http://wordpress.org/extend/plugins/wp-recentcomments/changelog/
- http://www.osvdb.org/75635
- http://www.securityfocus.com/bid/49734
- https://exchange.xforce.ibmcloud.com/vulnerabilities/70003