Cross-Site Scripting Vulnerability in 1-jquery-photo-gallery-slideshow-flash Plugin for WordPress

vendor:

1-jquery-photo-gallery-slideshow-flash Plugin for WordPress

by:

Unknown

4.3

CVSS

MEDIUM

Cross-Site Scripting

CWE

Product Name: 1-jquery-photo-gallery-slideshow-flash Plugin for WordPress

Affected Version From: 01.01

Affected Version To: 01.01

Patch Exists: NO

Related CWE:

CPE: a:1-jquery-photo-gallery-slideshow-flash:1.01

Metasploit:

Other Scripts:

Platforms Tested: WordPress

2012

Cross-Site Scripting Vulnerability in 1-jquery-photo-gallery-slideshow-flash Plugin for WordPress

The 1-jquery-photo-gallery-slideshow-flash plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Mitigation:

Update to the latest version of the 1-jquery-photo-gallery-slideshow-flash plugin or remove it if not needed. Additionally, implement input validation and output encoding to prevent cross-site scripting attacks.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/50860/info

1-jquery-photo-gallery-slideshow-flash plug-in for WordPress is prone to a cross-site-scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

1-jquery-photo-gallery-slideshow-flash 1.01 is vulnerable; other versions may also be affected.

UPDATE April 18, 2012: Further reports indicate this issue may not be a vulnerability; the issue can not be exploited as described. 

http://www.example.com/[path]/wp-content/plugins/1-jquery-photo-gallery-slideshow-flash/wp-1pluginjquery.php?page=[xss]