CVE-2017-12948 PressForward <= 5.2.3 - Cross-Site Scripting
MediumCVSS 6.1
EPSS 0.76%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATH_INFO to wp-admin/admin.php, related to PHP_SELF.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pressforward | <= 4.3.0 | No fix listed |
| wordpress pressforward(WordPress) | < 5.2.4 | 5.2.4 |
References
- www.defensecode.com third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org