CVE-2010-5295: XSS
Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML via a plugin's author field, which is not properly handled during a Delete Plugin action.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-5295?
CVE-2010-5295 is classified as a medium severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2010-5295?
To fix CVE-2010-5295, upgrade to WordPress version 3.0.2 or later, where the vulnerability has been addressed.
Who is affected by CVE-2010-5295?
CVE-2010-5295 affects various versions of WordPress prior to 3.0.2, specifically versions 2.0 to 2.8.6.
What are the potential impacts of CVE-2010-5295?
The potential impacts of CVE-2010-5295 include unauthorized JavaScript execution, which could lead to session hijacking or data theft.
How does CVE-2010-5295 occur?
CVE-2010-5295 occurs when user input in a plugin's author field is not properly sanitized during the deletion process.