| Title: Reflected XSS in wordpress plugin border-loading-bar v1.0 |
| Author: Larry W. Cashdollar, @_larry0 |
| Date: 2016-02-09 |
| Download Site: https://wordpress.org/plugins/border-loading-bar |
| Downloads: 1767 |
| Vendor Notified: 2016-02-09 |
| Export: Json |
| Vendor Contact: plugins@wordpress.org |
| Plugin Name: border-loading-bar |
| Vulnerability: There is a reflected XSS vulnerability in the following php code ./border-loading-bar/titan-framework/iframe-font-preview.php:
94: font-family: <?php echo $_GET['font-family'] ?>;
95: color: <?php echo $_GET['color'] ?>;
96: font-size: <?php echo $_GET['font-size'] ?>;
97: font-weight: <?php echo $_GET['font-weight'] ?>;
98: font-style: <?php echo $_GET['font-style'] ?>;
99: line-height: <?php echo $_GET['line-height'] ?>;
100: letter-spacing: <?php echo $_GET['letter-spacing'] ?>;
101: text-transform: <?php echo $_GET['text-transform'] ?>;
102: font-variant: <?php echo $_GET['font-variant'] ?>;
136: <body class='<?php echo $_GET['dark'] ?>'>
The variable font-family appears to send unsanitized data back to the users browser.
|
| CVE-ID: Not Released |
| File:./border-loading-bar/titan-framework/iframe-font-preview.php |
| Exploit Code: Exploit was derived from appearance of first vulnerable parameter in code, there could be more shown above.
|