CVEvulnerability
CVE-2012-6623
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-01-16
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an addforum action to wp-admin/admin.php.
Affected configurations
• vasthtml forumpress (<= 1.7.4)
• vasthtml forumpress 1.0
• vasthtml forumpress 1.1
• vasthtml forumpress 1.2
• vasthtml forumpress 1.3
• vasthtml forumpress 1.4
• vasthtml forumpress 1.5
• vasthtml forumpress 1.5.1
• vasthtml forumpress 1.5.2
• vasthtml forumpress 1.6
• vasthtml forumpress 1.6.2
• vasthtml forumpress 1.6.3
• vasthtml forumpress 1.6.4
• vasthtml forumpress 1.6.5
• vasthtml forumpress 1.6.6
• vasthtml forumpress 1.6.7
• vasthtml forumpress 1.6.8
• vasthtml forumpress 1.6.9
• vasthtml forumpress 1.7
• vasthtml forumpress 1.7.1
• vasthtml forumpress 1.7.2
• vasthtml forumpress 1.7.3
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://packetstormsecurity.org/files/112703/WordPress-WP-Forum-Server-1.7.3-SQL-Injection-Cross-Site-Scripting.html packetstormsecurity.org
- http://secunia.com/advisories/49167 Vendor Advisory
- http://wordpress.org/extend/plugins/forum-server/changelog/ Patch, Vendor Advisory
- https://plugins.trac.wordpress.org/changeset/572188 plugins.trac.wordpress.org
- http://packetstormsecurity.org/files/112703/WordPress-WP-Forum-Server-1.7.3-SQL-Injection-Cross-Site-Scripting.html packetstormsecurity.org
- http://secunia.com/advisories/49167 Vendor Advisory
- http://wordpress.org/extend/plugins/forum-server/changelog/ Patch, Vendor Advisory
- https://plugins.trac.wordpress.org/changeset/572188 plugins.trac.wordpress.org