Cross-Site Scripting vulnerabilities in Rating-Widget

vendor:

Rating-Widget

by:

Unknown

7.5

CVSS

HIGH

Cross-Site Scripting (XSS)

CWE

Product Name: Rating-Widget

Affected Version From: 1.3.2001

Affected Version To: Unknown (other versions may also be affected)

Patch Exists: NO

Related CWE:

CPE: a:rating_widget:rating_widget:1.3.1

Metasploit:

Other Scripts:

Platforms Tested: Unknown

Unknown

Cross-Site Scripting vulnerabilities in Rating-Widget

The Rating-Widget plugin is prone to multiple cross-site scripting vulnerabilities due to inadequate input sanitization. An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of a targeted user, potentially leading to the theft of authentication credentials and other malicious activities.

Mitigation:

To mitigate these vulnerabilities, it is recommended to update Rating-Widget to the latest version available. Additionally, website administrators should implement input validation and sanitization techniques to prevent the exploitation of XSS vulnerabilities.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/46904/info

Rating-Widget is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Rating-Widget 1.3.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/rating-widget/view/rating.php?vars[type]=[xss]
http://www.example.com/plugins/rating-widget/view/availability_options.php?selected_key=[xss]
http://www.example.com/wp-content/plugins/rating-widget/view/save.php?rw_form_hidden_field_name=[xss]