Description
Multiple cross-site scripting (XSS) vulnerabilities in the WP-FeedStats before 2.4 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, one of which involves an rss2 feed with an invalid or missing blog with an XSS sequence in the query string.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- WordPress Plugin WP-FeedStats 2.1 - HTML Injection EDB-30403 · webapps · Jul 26, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20070726 WordPress wp-feedstats persistent XSS mailing-list
- 25085 vdb-entry
- http://blogsecurity.net/wordpress/news-260707/
- http://bueltge.de/plugin-wp-feedstats-in-neuer-version/481/
- 37259 vdb-entry
- 26249 third-party-advisory
- wordpress-wpfeedstats-xss(35646) vdb-entry
- http://blogsecurity.net/news/news-130707/