Detections
Analytics
Slideshow Plugin for WordPress 'settings.php' Multiple Parameter XSS
medium Nessus Plugin ID 63302
Language:
Synopsis
The remote web server hosts a PHP script that is affected by multiple cross-site scripting vulnerabilities.Description
The version of Slideshow Plugin for WordPress installed on the remote host fails to properly sanitize user-supplied input to the 'settings' and 'inputFields' parameters of the 'settings.php' script before using them to generate dynamic HTML output. An attacker can leverage these issues to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.Successful exploitation of these vulnerabilities requires that PHP's 'register_globals' setting is set to 'on'.
Note that the install is also reportedly affected by an additional cross-site scripting issue as well as multiple path disclosure vulnerabilities; however, Nessus has not tested for these issues.
Solution
Upgrade to version 2.1.13 or later.See Also
Plugin Details
Severity: Medium
ID: 63302
File Name: wordpress_slideshow_multiple_xss.nasl
Version: 1.9
Type: remote
Family: CGI abuses : XSS
Published: 12/19/2012
Updated: 6/4/2024
Supported Sensors: Nessus
Enable CGI Scanning: true
Vulnerability Information
CPE: cpe:/a:wordpress:wordpress
Required KB Items: installed_sw/WordPress, www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Exploited by Nessus: true
Vulnerability Publication Date: 10/17/2011
Reference Information
BID: 56090