Multiple Plugins from Wow-Company - Reflected XSS
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.0.2, 3.0.4, 2.3.5, 1.5.1, 1.2.2, and 6 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: partial
Summary
The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button WordPress plugin before 5.3.1, Herd Effects WordPress plugin before 5.2.2, Popup Box WordPress plugin before 2.2.2, Side Menu Lite WordPress plugin before 4.0.2, Sticky Buttons WordPress plugin before 3.1.1, Wow Skype Buttons WordPress plugin before 4.0.2, WP Coder WordPress plugin before 2.5.6 do not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Unknown Float menu
fixed in 5.0.2
- Unknown Bubble Menu
fixed in 3.0.4
- Unknown Button Generator
fixed in 2.3.5
- Unknown Calculator Builder
fixed in 1.5.1
- Unknown Counter Box
fixed in 1.2.2
- Unknown Floating Button
fixed in 5.3.1
- Unknown Herd Effects
fixed in 5.2.2
- Unknown Popup Box
fixed in 2.2.2
- Unknown Side Menu Lite
fixed in 4.0.2
- Unknown Sticky Buttons
fixed in 3.1.1
- Unknown Wow Skype Buttons
fixed in 4.0.2
- Unknown WP Coder
fixed in 2.5.6