CVE-2018-18069

EPSS 13.2%

Vexday Risk Score

23Bajo

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

Madurez del exploit

Exploit funcional

Exploit automatizable disponible (Nuclei/Metasploit).

CVSS —EPSS 13.2%KEV nãoPoC —Nuclei simMetasploit —Patch —

Ciclo de vida

08 oct 2018Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.

Productos afectados

n/a · n/a

Referencias

https://0x62626262.wordpress.com/2018/10/08/sitepress-multilingual-cms-plugin-unauthenticated-stored-xss/