VulnerabilityModified

CVE-2014-4564

Cross-site scripting (XSS) vulnerability in check.php in the Validated plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter.

MEDIUM 4.3EPSS 1.63%

Does this matter?

Lower severity and a low EPSS score (1.63%). Track it; it rarely justifies an emergency change on its own.

Description

Cross-site scripting (XSS) vulnerability in check.php in the Validated plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter.

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS: 1.63% probability · 75th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: validated plugin project/validated plugin
Source: cve@mitre.org

References

http://codevigilant.com/disclosure/wp-plugin-validated-a3-cross-site-scripting-xssExploit
http://codevigilant.com/disclosure/wp-plugin-validated-a3-cross-site-scripting-xssExploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.