CVE-2012-6312 Video Lead Form < 0.6 - Cross-Site Scripting
MediumCVSS 4.3
EPSS 3.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a video-lead-form action to wp-admin/admin.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| video-lead-form uk-cookie | All versions | No fix listed |
| wordpress video-lead-form(WordPress) | < 0.6 | 0.6 |
References
- 20121207 Update on CVE assigned for Video Lead Form Plugin Cross-Site mailing-list
- wordpress.org vendor-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org