oss-security - CVE-request: WordPress wp-facethumb plugin reflected XSS vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120515194125.GA10065@kludge.henri.nerv.fi>
Date: Tue, 15 May 2012 22:41:25 +0300
From: Henri Salo <henri@...v.fi>
To: oss-security@...ts.openwall.com
Subject: CVE-request: WordPress wp-facethumb plugin reflected XSS
 vulnerability

Hello,

WordPress plugin wp-facethumb version 0.1 is affected to reflected XSS vulnerability. This issue is fixed in version 0.2. Could I get 2012 CVE-identifier for this issue, thanks.

Changelog: http://plugins.svn.wordpress.org/wp-facethumb/trunk/readme.txt
Original advisory: http://cxsecurity.com/issue/WLB-2012050106
My report to developer: http://wordpress.org/support/topic/plugin-wp-facethumb-reflected-xss-vulnerability-cwe-79
Plugin URL: http://wordpress.org/extend/plugins/wp-facethumb/ (will show up very soon. WP admins disabled this until fix is done)

Diff included between tags 0.1 and 0.2.

- Henri Salo

View attachment "wp-facethumb.diff" of type "text/x-diff" (11086 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.