CVE-2012-2920 User Photo <= 0.9.5 - Cross-Site Scripting
MediumCVSS 4.3
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the userphoto_options_page function in user-photo.php in the User Photo plugin before 0.9.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to wp-admin/options-general.php. NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| user photo | <= 0.9.5 | No fix listed |
| user photo | = 0.7.0.1 | No fix listed |
| user photo | = 0.7.1 | No fix listed |
| user photo | = 0.7.2 | No fix listed |
| user photo | = 0.7.3 | No fix listed |
| user photo | = 0.7.4 | No fix listed |
| user photo | = 0.7.4b | No fix listed |
| user photo | = 0.8 | No fix listed |
| user photo | = 0.8.0.1 | No fix listed |
| user photo | = 0.8.0.2 | No fix listed |
| user photo | = 0.8.0.3 | No fix listed |
| user photo | = 0.8.0.4 | No fix listed |
| user photo | = 0.8.0.5 | No fix listed |
| user photo | = 0.8.1 | No fix listed |
| user photo | = 0.9 | No fix listed |
| user photo | = 0.9.1 | No fix listed |
| user photo | = 0.9.2 | No fix listed |
| user photo | = 0.9.3 | No fix listed |
| user photo | = 0.9.4 | No fix listed |
| wordpress user-photo(WordPress) | < 0.9.5.2 | 0.9.5.2 |
References
- 81806 vdb-entry
- plugins.trac.wordpress.org
- 49100 third-party-advisory vendor-advisory
- wordpress.org
- 53449 vdb-entry
- userphoto-optionsgeneral-xss(75496) vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org