CVE-2011-4926
published 2012-08-29CVE-2011-4926: Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to…
PriorityP270medium4.3CVSS 2.0
AVNACMAuNCNIPAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
10.91%
95.3th percentile
Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Affected
54 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bueltge | adminimize | <= 1.7.21 | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
| bueltge | adminimize | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url{{BaseURL}}/wp-content/plugins/adminimize/adminimize_page.php?page=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E
path/wp-content/plugins/adminimize/readme.txt
- →Probe for the vulnerable endpoint by requesting adminimize_page.php with a crafted XSS payload in the 'page' parameter; a vulnerable instance will reflect the payload (e.g., alert(document.domain)) in the response body with Content-Type text/html and HTTP 200.
- →Confirm plugin presence before exploitation by checking for the string 'Adminimize ===' in /wp-content/plugins/adminimize/readme.txt.
- →Use the Google dork 'inurl:"/wp-content/plugins/adminimize/"' to identify WordPress sites with the Adminimize plugin installed.
- →The vulnerable parameter is 'page' in adminimize_page.php; unsanitised input is reflected directly into the HTML response, enabling script injection. ↗
- ·CVE-2011-4926 specifically covers the 'page' parameter in adminimize_page.php; the related CVE-2011-5128 covers additional parameters (post, post_ID) and additional files (deinstall_options.php, theme_options.php, im_export_options.php) — do not conflate the two. ↗
- ·Versions prior to 1.7.22 are confirmed vulnerable; the fix was introduced in 1.7.22. ↗
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vulncheck4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hvgm-xqxx-g9pr: Multiple cross-site scripting (XSS) vulnerabilities in the Adminimize plugin before 1
ghsa_unreviewed·2022-05-17·CVSS 4.3
CVE-2011-5128 [MEDIUM] CWE-79 GHSA-hvgm-xqxx-g9pr: Multiple cross-site scripting (XSS) vulnerabilities in the Adminimize plugin before 1
Multiple cross-site scripting (XSS) vulnerabilities in the Adminimize plugin before 1.7.22 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) inc-options/deinstall_options.php, (2) inc-options/theme_options.php, or (3) inc-options/im_export_options.php, or the (4) post or (5) post_ID parameters to adminimize.php, different vectors than CVE-2011-4926.
GHSA
GHSA-mmvc-933r-7cp3: Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page
ghsa_unreviewed·2022-05-14
CVE-2011-4926 [MEDIUM] CWE-79 GHSA-mmvc-933r-7cp3: Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page
Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
VulnCheck
bueltge adminimize Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
vulncheck·2011·CVSS 4.3
CVE-2011-4926 [MEDIUM] bueltge adminimize Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
bueltge adminimize Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Affected: bueltge adminimize
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.f5.com/labs/articles/threat-intelligence/sensor-intel-series-top-cves-august-2024; https://www.f5.com/labs/articles/threat-intelligence/botpoke-scanner-switches-ip
No detection rules found.
Exploit-DB
WordPress Plugin Adminimize 1.7.21 - 'page' Cross-Site Scripting
exploitdb·2011-11-21
CVE-2011-4926 WordPress Plugin Adminimize 1.7.21 - 'page' Cross-Site Scripting
WordPress Plugin Adminimize 1.7.21 - 'page' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/50745/info
Adminimize plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Adminimize 1.7.21 is vulnerable; other versions may also be affected.
http://www.example.com/[path]/wp-content/plugins/adminimize/adminimize_page.php?page=[xss]
Nuclei
Adminimize 1.7.22 - Cross-Site Scripting
nuclei·CVSS 4.3
CVE-2011-4926 [MEDIUM] Adminimize 1.7.22 - Cross-Site Scripting
Adminimize 1.7.22 - Cross-Site Scripting
A cross-site scripting vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Template:
id: CVE-2011-4926
info:
name: Adminimize 1.7.22 - Cross-Site Scripting
author: daffainfo
severity: medium
description: A cross-site scripting vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
impact: |
Allows attackers to inject malicious scripts into web pages viewed by users, leading to potential data theft or unauthorized actions.
remediation: |
Update to the latest version of Adminimize pl
No writeups or analysis indexed.
http://plugins.trac.wordpress.org/changeset?reponame=&new=467338%40adminimize&old=466900%40adminimize#file5http://wordpress.org/extend/plugins/adminimize/changelog/http://www.openwall.com/lists/oss-security/2012/01/05/10http://www.openwall.com/lists/oss-security/2012/01/10/9http://www.osvdb.org/77472http://www.securityfocus.com/archive/1/520591http://www.securityfocus.com/archive/1/520591/100/0/threadedhttp://www.securityfocus.com/bid/50745https://exchange.xforce.ibmcloud.com/vulnerabilities/71414http://plugins.trac.wordpress.org/changeset?reponame=&new=467338%40adminimize&old=466900%40adminimize#file5http://wordpress.org/extend/plugins/adminimize/changelog/http://www.openwall.com/lists/oss-security/2012/01/05/10http://www.openwall.com/lists/oss-security/2012/01/10/9http://www.osvdb.org/77472http://www.securityfocus.com/archive/1/520591http://www.securityfocus.com/archive/1/520591/100/0/threadedhttp://www.securityfocus.com/bid/50745https://exchange.xforce.ibmcloud.com/vulnerabilities/71414
2012-08-29
Published
Exploited in the wild