CVE-2018-17884 - XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook (gwolle-gb) plugin before 2.5.4 for WordPress via the PATH_INFO to wp-admin/index.php

Back Back to CVE browser

MEDIUM

XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook (gwolle-gb) plugin before 2.5.4 for WordPress via the PATH_INFO to wp-admin/index.php

Published Oct 2, 2018

6.1

MEDIUM

CVSS 3.0

EPSS 1.21%

Description

XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook (gwolle-gb) plugin before 2.5.4 for WordPress via the PATH_INFO to wp-admin/index.php

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

http://www.defensecode.com/advisories/DC-2018-05-008_WordPress_Gwolle_Guestbook_Plugin_Advisory.pdf
x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-9625
Advisory
https://seclists.org/bugtraq/2018/Jul/74
x_refsource_MISCExploitMailing ListThird Party Advisory
https://wordpress.org/plugins/gwolle-gb/#developers
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
http://www.defensecode.com/advisories/DC-2018-05-008_WordPress_Gwolle_Guestbook_Plugin_Advisory.pdf		x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-9625		Advisory
https://seclists.org/bugtraq/2018/Jul/74		x_refsource_MISCExploitMailing ListThird Party Advisory
https://wordpress.org/plugins/gwolle-gb/#developers		x_refsource_MISCThird Party Advisory