Wp Construction Mode Vulnerabilities

The WP Construction Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘set_opt’ parameter in versions up to, and including, 1.91 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVSS:

6.1

Affected:

up to 1.91

Fixed in:

1.92

Disclosed:

Dec 15, 2014

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Affected:

up to 1.92

Fixed in:

1.92

Disclosed:

Dec 15, 2014

The WP Construction Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘set_opt’ parameter in versions up to, and including, 1.91 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

Affected:

up to 1.92

Fixed in:

1.92

Disclosed:

Dec 15, 2014

Cross-site scripting (XSS) vulnerability in the WP Construction Mode plugin 1.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wuc_logo parameter in a save action to wp-admin/admin.php.

CVSS:

6.1

Affected:

up to 1.8

Fixed in:

1.9

Disclosed:

Aug 1, 2014

CVE-2014-4854 on NVD →

[en] Cross-site scripting (XSS) vulnerability in the WP Construction Mode plugin 1.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wuc_logo parameter in a save action to wp-admin/admin.php.

Affected:

up to 1.9

Fixed in:

1.9

Disclosed:

Jul 10, 2014

CVE-2014-4854 on NVD →

The WP Construction Mode WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.

Affected:

up to 1.92

Fixed in:

1.92