Flagem Vulnerabilities

The FlagEm plugin for WordPress is vulnerable to Cross-Site Scripting due to insufficient input sanitization and output escaping via the 'cID' parameter in the 'flagit.php' file. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:

6.1

Affected:

up to *

Fix:

No patched version reported

Disclosed:

Jul 22, 2013

FlagEm plugin's "cID" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authentication credentials....

Affected:

up to 1.1

Fixed in:

1.1

Disclosed:

Jul 22, 2013

The FlagEm plugin for WordPress is vulnerable to Cross-Site Scripting due to insufficient input sanitization and output escaping via the 'cID' parameter in the 'flagit.php' file. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.

Affected:

up to 100

Fix:

No patched version reported

Disclosed:

Jul 22, 2013

The FlagEm WordPress plugin was affected by a flagit.php cID Parameter XSS security vulnerability.

Affected:

up to 1.0

Fix:

No patched version reported