HackDig : Dig high-quality web security articles for hacker

Stored Cross-Site Scripting vulnerability in 404 to 301 WordPress Plugin

2016-11-08 18:10

------------------------------------------------------------------------
Stored Cross-Site Scripting vulnerability in 404 to 301 WordPress Plugin
------------------------------------------------------------------------
Alyssa Milburn <amilburn.at.zall.org>, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A stored Cross-Site Scripting vulnerability was found in the 404 to 301
WordPress Plugin. This issue can be exploited by an anonymous user and
allows an attacker to perform a wide variety of actions, such as
stealing users' session tokens, or performing arbitrary actions on their
behalf.

------------------------------------------------------------------------
OVE ID
------------------------------------------------------------------------
OVE-20160719-0003

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on 404 to 301 WordPress Plugin
version 2.2.8.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
This issue is resolved in 404 to 301 WordPress Plugin version 2.3.1.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_404_to_301_wordpress_plugin.html

------------------------------------------------------------------------
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its
goal is to contribute to the security of popular, widely used OSS
projects in a fun and educational way.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/


Source: 64/voN/6102/erusolcsidlluf/gro.stsilces

Read:747 | Comments:0 | Tags: Vulnerability

“Stored Cross-Site Scripting vulnerability in 404 to 301 WordPress Plugin”0 Comments

Submit A Comment

Name:

Email:

Blog :

Verification Code:

Announce

Share high-quality web security related articles with you:)

Tools

Tag Cloud