CVE-2015-7357 uDesign Theme 2.3.0 - 2.7.9 - Unauthenticated DOM Cross-Site Scripting
MediumCVSS 6.1
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via a fragment identifier, as demonstrated by #<svg onload=alert(1)>.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| udesign project udesign | = 2.3.0 | No fix listed |
| udesign project udesign | = 2.3.1 | No fix listed |
| udesign project udesign | = 2.4.0 | No fix listed |
| udesign project udesign | = 2.4.1 | No fix listed |
| udesign project udesign | = 2.4.2 | No fix listed |
| udesign project udesign | = 2.4.3 | No fix listed |
| udesign project udesign | = 2.4.4 | No fix listed |
| udesign project udesign | = 2.4.5 | No fix listed |
| udesign project udesign | = 2.4.6 | No fix listed |
| udesign project udesign | = 2.4.7 | No fix listed |
| udesign project udesign | = 2.4.8 | No fix listed |
| udesign project udesign | = 2.4.9 | No fix listed |
| udesign project udesign | = 2.4.10 | No fix listed |
| udesign project udesign | = 2.4.11 | No fix listed |
| udesign project udesign | = 2.4.12 | No fix listed |
| udesign project udesign | = 2.4.13 | No fix listed |
| udesign project udesign | = 2.4.14 | No fix listed |
| udesign project udesign | = 2.4.15 | No fix listed |
| udesign project udesign | = 2.4.16 | No fix listed |
| udesign project udesign | = 2.4.17 | No fix listed |
| udesign project udesign | = 2.4.18 | No fix listed |
| udesign project udesign | = 2.4.19 | No fix listed |
| udesign project udesign | = 2.5.0 | No fix listed |
| udesign project udesign | = 2.5.1 | No fix listed |
| udesign project udesign | = 2.5.2 | No fix listed |
Show 16 more
| Product | Affected versions | Fixed in |
|---|---|---|
| udesign project udesign | = 2.5.3 | No fix listed |
| udesign project udesign | = 2.5.4 | No fix listed |
| udesign project udesign | = 2.5.5 | No fix listed |
| udesign project udesign | = 2.5.6 | No fix listed |
| udesign project udesign | = 2.6.0 | No fix listed |
| udesign project udesign | = 2.7.0 | No fix listed |
| udesign project udesign | = 2.7.1 | No fix listed |
| udesign project udesign | = 2.7.2 | No fix listed |
| udesign project udesign | = 2.7.3 | No fix listed |
| udesign project udesign | = 2.7.4 | No fix listed |
| udesign project udesign | = 2.7.5 | No fix listed |
| udesign project udesign | = 2.7.6 | No fix listed |
| udesign project udesign | = 2.7.7 | No fix listed |
| udesign project udesign | = 2.7.8 | No fix listed |
| udesign project udesign | = 2.7.9 | No fix listed |
| wordpress u-design(WordPress) | >= 2.3.0, < 2.7.10 | 2.7.10 |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- 20151005 u-design wordpress theme DOM XSS mailing-list third-party-advisory
- themeforest.net third-party-advisory
- wpvulndb.com third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org