medium4.8Public exploit code
CVE-2018-13832
Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPress allow remote atta…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin All In One Favicon 4.6 - (Authenticated) Cross-Site Scripting2018-07-19 · webapps · php
Impact
Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via Apple-Text, GIF-Text, ICO-Text, PNG-Text, or JPG-Text.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Techotronic | All In One Favicon | before 4.6 |
Weakness classification
References
- NVD record
- CVE.org record
- https://hackpuntes.com/cve-2018-13832-wordpress-plugin-all-in-one-favicon-4-6-autenticado-multiples-cross-site-scripting-persistentes/
- https://www.exploit-db.com/exploits/45056/
- https://hackpuntes.com/cve-2018-13832-wordpress-plugin-all-in-one-favicon-4-6-autenticado-multiples-cross-site-scripting-persistentes/
- https://www.exploit-db.com/exploits/45056/