CVE-2012-10018 Mapplic Lite and Mapplic <= (Various Versions) - Server Side Request Forgery to Cross-Site Scirpting
HighCVSS 8.3
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 respectively. This makes it possible for attackers to forgery requests coming from a vulnerable site's server and ultimately perform an XSS attack if requesting an SVG file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sekler Mapplic Lite | < 1.0.1 | 1.0.1 |
| sekler Mapplic - Custom Interactive Map WordPress Plugin | < 6.2 | 6.2 |
| mapplic | < 6.2 | 6.2 |
| mapplic lite | < 1.0.1 | 1.0.1 |
| wordpress mapplic-lite(WordPress) | < 1.0.1 | 1.0.1 |
| wordpress mapplic(WordPress) | < 6.2 | 6.2 |
| mapplic | <= 1.0 | No fix listed |
| mapplic | <= 6.1 | No fix listed |
References
- www.wordfence.com third-party-advisory
- packetstormsecurity.com exploit third-party-advisory
- packetstormsecurity.com exploit third-party-advisory
- www.mapplic.com release-notes
- plugins.trac.wordpress.org patch
- Wordfence Intelligence third-party-advisory
- www.cve.org