CVE-2012-6622 WP Forum Server <= 1.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting
MediumCVSS 4.3
EPSS 5.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) groupid parameter in an editgroup action or (2) usergroup_id parameter in an edit_usergroup action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress forum-server(WordPress) | < 1.7.4 | 1.7.4 |
| vasthtml forumpress | <= 1.7.4 | No fix listed |
| vasthtml forumpress | = 1.0 | No fix listed |
| vasthtml forumpress | = 1.1 | No fix listed |
| vasthtml forumpress | = 1.2 | No fix listed |
| vasthtml forumpress | = 1.3 | No fix listed |
| vasthtml forumpress | = 1.4 | No fix listed |
| vasthtml forumpress | = 1.5 | No fix listed |
| vasthtml forumpress | = 1.5.1 | No fix listed |
| vasthtml forumpress | = 1.5.2 | No fix listed |
| vasthtml forumpress | = 1.6 | No fix listed |
| vasthtml forumpress | = 1.6.2 | No fix listed |
| vasthtml forumpress | = 1.6.3 | No fix listed |
| vasthtml forumpress | = 1.6.4 | No fix listed |
| vasthtml forumpress | = 1.6.5 | No fix listed |
| vasthtml forumpress | = 1.6.6 | No fix listed |
| vasthtml forumpress | = 1.6.7 | No fix listed |
| vasthtml forumpress | = 1.6.8 | No fix listed |
| vasthtml forumpress | = 1.6.9 | No fix listed |
| vasthtml forumpress | = 1.7 | No fix listed |
| vasthtml forumpress | = 1.7.1 | No fix listed |
| vasthtml forumpress | = 1.7.2 | No fix listed |
| vasthtml forumpress | = 1.7.3 | No fix listed |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- packetstormsecurity.org exploit
- 49155 third-party-advisory vendor-advisory
- wordpress.org patch vendor-advisory
- 53530 vdb-entry
- plugins.trac.wordpress.org