CVE-2015-2218

Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) item[name] or (2) item[customcss] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or the itemid parameter in the (3) wonderplugin_audio_show_item or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php.
Configurations

Configuration 1 (hide)

cpe:2.3:a:magic_hills:wonderplugin_audio_player:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 02:27

Type Values Removed Values Added
References () http://osvdb.org/show/osvdb/118510 - () http://osvdb.org/show/osvdb/118510 -
References () http://osvdb.org/show/osvdb/118511 - () http://osvdb.org/show/osvdb/118511 -
References () http://security.szurek.pl/wonderplugin-audio-player-20-blind-sql-injection-and-xss.html - Exploit () http://security.szurek.pl/wonderplugin-audio-player-20-blind-sql-injection-and-xss.html - Exploit
References () http://www.exploit-db.com/exploits/36086 - Exploit () http://www.exploit-db.com/exploits/36086 - Exploit
References () http://www.securityfocus.com/bid/74851 - () http://www.securityfocus.com/bid/74851 -
References () http://www.wonderplugin.com/wordpress-audio-player/ - Vendor Advisory () http://www.wonderplugin.com/wordpress-audio-player/ - Vendor Advisory

Information

Published : 2015-03-05 16:59

Updated : 2024-11-21 02:27


NVD link : CVE-2015-2218

Mitre link : CVE-2015-2218

CVE.ORG link : CVE-2015-2218


JSON object : View

Products Affected

magic_hills

  • wonderplugin_audio_player
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')