Detections
Analytics
Traffic Analyzer Plugin for WordPress 'ta_loaded.js.php' 'aoid' Parameter XSS
medium Nessus Plugin ID 66176
Language:
Synopsis
The remote web server hosts a PHP script that is affected by a cross- site scripting vulnerability.Description
The version of the Traffic Analyzer plugin for WordPress installed on the remote host fails to properly sanitize user-supplied input to the 'aoid' parameter of the 'ta_loaded.js.php' script before using it to generate dynamic HTML output. An attacker can leverage this issue to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.Solution
Upgrade to version 3.4.0 or later.See Also
Plugin Details
Severity: Medium
ID: 66176
File Name: wordpress_traffic_analyzer_aoid_xss.nasl
Version: 1.9
Type: remote
Family: CGI abuses : XSS
Published: 4/22/2013
Updated: 6/5/2024
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Low
Score: 3.8
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:wordpress:wordpress
Required KB Items: installed_sw/WordPress, www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Patch Publication Date: 7/14/2013
Vulnerability Publication Date: 4/9/2013
Reference Information
CVE: CVE-2013-3526
BID: 58948