CVE-2014-5196
Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for…
Does this matter?
Lower severity and a low EPSS score (2.13%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the iusib_meta_fields parameter.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 2.13% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- improved user search in backend project/improved user search in backend
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/60590
- http://wordpress.org/plugins/improved-user-search-in-backend/changelogPatch, Vendor Advisory
- https://security.dxw.com/advisories/csrf-and-xss-in-improved-user-search-allow-execution-of-arbitrary-javascript-in-wordpress-admin-area/Exploit
- http://secunia.com/advisories/60590
- http://wordpress.org/plugins/improved-user-search-in-backend/changelogPatch, Vendor Advisory
- https://security.dxw.com/advisories/csrf-and-xss-in-improved-user-search-allow-execution-of-arbitrary-javascript-in-wordpress-admin-area/Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.