VulnerabilityModified
CVE-2012-6506
Multiple cross-site scripting (XSS) vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in zing.inc.php or (2) notes parameter in…
MEDIUM 4.3EPSS 5.31%
Does this matter?
Lower severity and a low EPSS score (5.31%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in zing.inc.php or (2) notes parameter in fws/pages-front/onecheckout.php.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 5.31% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- zingiri/zingiri web shop
- Source
- cve@mitre.org
References
- http://plugins.trac.wordpress.org/changeset?reponame=&old=537613%40zingiri-web-shop&new=537613%40zingiri-web-shopExploit, Patch
- http://secunia.com/advisories/48991Vendor Advisory
- http://wordpress.org/extend/plugins/zingiri-web-shop/changelog/
- http://www.exploit-db.com/exploits/18787Exploit
- http://www.osvdb.org/81492
- http://www.osvdb.org/81493
- http://www.securityfocus.com/bid/53278
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75178
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75179
- http://plugins.trac.wordpress.org/changeset?reponame=&old=537613%40zingiri-web-shop&new=537613%40zingiri-web-shopExploit, Patch
- http://secunia.com/advisories/48991Vendor Advisory
- http://wordpress.org/extend/plugins/zingiri-web-shop/changelog/
- http://www.exploit-db.com/exploits/18787Exploit
- http://www.osvdb.org/81492
- http://www.osvdb.org/81493
- http://www.securityfocus.com/bid/53278
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75178
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75179
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.