Cross-Site Scripting in Advanced Text Widget plugin for WordPress

vendor:

Advanced Text Widget plugin

by:

Unknown

5.5

CVSS

MEDIUM

Cross-Site Scripting

CWE

Product Name: Advanced Text Widget plugin

Affected Version From: 2.0.0

Affected Version To: 2.0.0 (other versions may also be affected)

Patch Exists: NO

Related CWE: Not provided

CPE: a:wordpress:advanced_text_widget:2.0.0

Metasploit:

Other Scripts:

Platforms Tested: WordPress

2012

Cross-Site Scripting in Advanced Text Widget plugin for WordPress

The Advanced Text Widget plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Mitigation:

Update to a patched version of the Advanced Text Widget plugin for WordPress. Alternatively, disable or remove the plugin until a fix is available.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/50744/info

Advanced Text Widget plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Advanced Text Widget 2.0.0 is vulnerable; other versions may also be affected.

UPDATE Apr 18, 2012: Further reports indicate the issue reported may not be valid. This BID will be updated as more information emerges. 

http://www.example.com/[path]/wp-content/plugins/advanced-text-widget/advancedtext.php?page=[xss]