CVE-2012-5388

White Label CMS < 1.5.1 - Cross-Site Scripting

highImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

7.1

CVSS Score

7.1

CVSS Score

high

Severity

1.5.1

Patched in

4111d

Time to patch

Description

Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, a related issue to CVE-2012-5387.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Low

Confidentiality

Low

Integrity

Low

Availability

Technical Details

Affected versions<1.5.1

PublishedOctober 21, 2012

Last updatedJanuary 22, 2024

Affected pluginwhite-label-cms

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/97fc00d0-ca3d-462a-ac9f-bfac4c882cc1?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database