WordPress Calls to Action <=2.4.3 - Authenticated Reflected XSS
Calls to Action plugin before 2.5.1 for WordPress contains stored XSS caused by unsanitized input in open-tab parameter in wp-admin/edit.php and wp-cta-variation-id parameter in ab-testing-call-to-action-example/, letting remote attackers inject arbitrary web script or HTML, exploit requires sending crafted requests. References: https://www.immuniweb.com/advisory/HTB23274 https://seclists.org/bugtraq/2015/Dec/9 https://nvd.nist.gov/vuln/detail/CVE-2015-8350 https://plugins.trac.wordpress.org/changeset/1274208/cta http://packetstormsecurity.com/files/134598/WordPress-Calls-To-Action-2.4.3-Cross-Site-Scripting.html Remediation: Update to version 2.5.1 or later to fix the vulnerabilities.
10 assets checked · domain, subdomain, ipv4