CVE-2015-2084 Easy Social Icons <= 1.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
MediumCVSS 6.8
EPSS 2.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the image_file parameter in an edit action in the cnss_social_icon_add page to wp-admin/admin.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cybernetikz easy social icons | <= 1.2.2 | No fix listed |
| wordpress easy-social-icons(WordPress) | < 1.2.3 | 1.2.3 |
References
- packetstormsecurity.com exploit
- 20150221 Easy Social Icons WordPress plugin v1.2.2 Persistent XSS and CSRF exploit mailing-list
- 36161 exploit
- 74893 vdb-entry
- wordpress.org
- Wordfence Intelligence third-party-advisory
- www.cve.org