CVE-2019-16525
published 2019-09-19CVE-2019-16525: An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file…
PriorityP341medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
5.55%
91.9th percentile
An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file, and it is possible to inject JavaScript code.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| checklist | checklist | < 1.1.9 | 1.1.9 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
WordPress Checklist <1.1.9 - Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2019-16525 [MEDIUM] WordPress Checklist <1.1.9 - Cross-Site Scripting
WordPress Checklist alert(document.domain)"
- type: word
part: header
words:
- text/html
- type: status
status:
- 200
# digest: 4b0a00483046022100fd0490fa4313fff151712c6e5f97db3fdf26759e3a9899a51796802f4c482759022100b80d7f5565281a88248b07f14c2c6adba0cb240d9e4e40a22c46ddef88aab12b:922c64590222798bb761d5b6d8e72950
No writeups or analysis indexed.
https://packetstormsecurity.com/files/154436/WordPress-Checklist-1.1.5-Cross-Site-Scripting.htmlhttps://plugins.trac.wordpress.org/changeset/2155029/https://wordpress.org/plugins/checklist/#developershttps://wpvulndb.com/vulnerabilities/9877https://packetstormsecurity.com/files/154436/WordPress-Checklist-1.1.5-Cross-Site-Scripting.htmlhttps://plugins.trac.wordpress.org/changeset/2155029/https://wordpress.org/plugins/checklist/#developershttps://wpvulndb.com/vulnerabilities/9877
2019-09-19
Published