CVE-2019-17515 - The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS)

Back Back to CVE browser

MEDIUM

The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS)

Published Nov 13, 2019

6.1

MEDIUM

CVSS 3.1

EPSS 1.31%

Description

The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter. The component is: inc/cleantalk-users.php and inc/cleantalk-comments.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://plugins.trac.wordpress.org/changeset/2172333
x_refsource_MISCPatchThird Party Advisory
https://wordpress.org/plugins/cleantalk-spam-protect/#developers
x_refsource_MISCProductThird Party Advisory
https://wpvulndb.com/vulnerabilities/9949
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://plugins.trac.wordpress.org/changeset/2172333		x_refsource_MISCPatchThird Party Advisory
https://wordpress.org/plugins/cleantalk-spam-protect/#developers		x_refsource_MISCProductThird Party Advisory
https://wpvulndb.com/vulnerabilities/9949		x_refsource_MISCThird Party Advisory