Wp Timed Popup Vulnerabilities

[en] Multiple cross-site request forgery (CSRF) vulnerabilities in the Timed Popup (wp-timed-popup) plugin 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site scripting (XSS) attacks via th...

Affected:

up to 1.4

Fix:

No patched version reported

Disclosed:

Jan 5, 2015

CVE-2014-9525 on NVD →

The WP Timed Popout plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting via the ‘option_name’ parameter in versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pa...

CVSS:

6.1

Affected:

up to 1.3

Fixed in:

1.4

Disclosed:

Dec 14, 2014

The WP Timed Popout plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting via the ‘option_name’ parameter in versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pa...

Affected:

up to 1.4

Fixed in:

1.4

Disclosed:

Dec 14, 2014

Multiple cross-site request forgery (CSRF) vulnerabilities in the Timed Popup (wp-timed-popup) plugin 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site scripting (XSS) attacks via the sc_...

CVSS:

6.1

Affected:

up to 1.4

Fix:

No patched version reported

Disclosed:

Dec 12, 2014

CVE-2014-9525 on NVD →

The wp-timed-popup WordPress plugin was affected by a CSRF & Stored XSS security vulnerability.

Affected:

up to 1.3

Fix:

No patched version reported