CVE-2015-4127

EPSS 7.5%

Vexday Risk Score

38Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 7.5%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

26 May 2015Public PoC

28 May 2015Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML via the address parameter, as demonstrated by a request to index.php/2015/05/21/church_admin-registration-form/.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.com/files/132034/WordPress-Church-Admin-0.800-Cross-Site-Scripting.htmlunverified cve_referencewww.exploit-db.com/exploits/37112/unverified exploitdbwww.exploit-db.com/exploits/37112unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/132034/WordPress-Church-Admin-0.800-Cross-Site-Scripting.html https://wordpress.org/plugins/church-admin/changelog/https://www.exploit-db.com/exploits/37112/http://www.osvdb.org/121304 http://www.securityfocus.com/bid/74782