medium4.8
CVE-2018-5363
WPGlobus plugin Stored XSS & CSRF security vulnerability
Impact
The WPGlobus plugin 1.9.6 for WordPress has XSS via the `wpglobus_option[enabled_languages][en]` or `wpglobus_option[enabled_languages][fr]` (or any other language) parameter to `wp-admin/options.php`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | wpglobus/wpglobus | <= 1.9.6 | 1.9.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wpglobus | Wpglobus | Version 1.9.6 |