CVE-2014-9311
published 2015-04-14CVE-2014-9311: Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject…
PriorityP419low3.5CVSS 2.0
AVNACMAuSCNIPAN
EXPLOIT
EPSS
3.89%
88.9th percentile
Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the location[id] parameter in a shareaholic_add_location action to wp-admin/admin-ajax.php.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| shareaholic | shareaholic | <= 7.6.0.9 | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/131321/WordPress-Shareaholic-7.6.0.3-Cross-Site-Scripting.htmlhttp://security.szurek.pl/shareaholic-7603-xss.htmlhttps://wordpress.org/plugins/shareaholic/changelog/http://packetstormsecurity.com/files/131321/WordPress-Shareaholic-7.6.0.3-Cross-Site-Scripting.htmlhttp://security.szurek.pl/shareaholic-7603-xss.htmlhttps://wordpress.org/plugins/shareaholic/changelog/
2015-04-14
Published