VulnerabilityModified

CVE-2011-4618

Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.

MEDIUM 4.3EPSS 10.1%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 10.1%, higher than 95% of all known CVEs. Patch or mitigate before the next change window.

Description

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS: 10.08% probability · 95th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: simplerealtytheme/advanced text widget plugin
Source: secalert@redhat.com

References

http://archives.neohapsis.com/archives/bugtraq/2012-04/0119.htmlExploit
http://plugins.trac.wordpress.org/changeset?reponame=&new=466102%40advanced-text-widget&old=465828%40advanced-text-widget
http://wordpress.org/extend/plugins/advanced-text-widget/changelog/
http://wordpress.org/support/topic/wordpress-advanced-text-widget-plugin-cross-site-scripting-vulnerabilities
http://www.openwall.com/lists/oss-security/2011/12/19/6
http://www.securityfocus.com/archive/1/520589Exploit
http://www.securityfocus.com/bid/50744Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/71412
http://archives.neohapsis.com/archives/bugtraq/2012-04/0119.htmlExploit
http://plugins.trac.wordpress.org/changeset?reponame=&new=466102%40advanced-text-widget&old=465828%40advanced-text-widget
http://wordpress.org/extend/plugins/advanced-text-widget/changelog/
http://wordpress.org/support/topic/wordpress-advanced-text-widget-plugin-cross-site-scripting-vulnerabilities
http://www.openwall.com/lists/oss-security/2011/12/19/6
http://www.securityfocus.com/archive/1/520589Exploit
http://www.securityfocus.com/bid/50744Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/71412

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.