CVE-2011-5106 Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting
MediumCVSS 4.3
EPSS 10.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fractalia flexible custom post type | = 0.1 | No fix listed |
| fractalia flexible custom post type | = 0.1.3 | No fix listed |
| fractalia flexible custom post type | = 0.1.4 | No fix listed |
| fractalia flexible custom post type | = 0.1.5 | No fix listed |
| wordpress flexible-custom-post-type(WordPress) | < 0.1.7 | 0.1.7 |
References
- plugins.trac.wordpress.org exploit patch
- wordpress.org vendor-advisory
- 20111116 wordpress Flexible Custom Post Type plugin Xss Vulnerabilities mailing-list
- 50719 exploit vdb-entry
- flexiblecustomposttype-editpost-xss(71415) vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org