CVE-2019-14795 - The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter

Back Back to CVE browser

MEDIUM

The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter

Published Aug 15, 2019

4.8

MEDIUM

CVSS 3.0

EPSS 1.03%

Description

The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://wordpress.org/plugins/toggle-the-title/#developers
x_refsource_MISCProduct
https://wpvulndb.com/vulnerabilities/9516
x_refsource_MISCThird Party Advisory
https://www.pluginvulnerabilities.com/2019/05/16/is-this-authenticated-persistent-cross-site-scripting-xss-vulnerability-what-hackers-would-be-interested-in-toggle-the-title-for/
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://wordpress.org/plugins/toggle-the-title/#developers		x_refsource_MISCProduct
https://wpvulndb.com/vulnerabilities/9516		x_refsource_MISCThird Party Advisory
https://www.pluginvulnerabilities.com/2019/05/16/is-this-authenticated-persistent-cross-site-scripting-xss-vulnerability-what-hackers-would-be-interested-in-toggle-the-title-for/		x_refsource_MISCExploitThird Party Advisory