CVE-2012-6506: XSS
First published: Thu Jan 24 2013(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in zing.inc.php or (2) notes parameter in fws/pages-front/onecheckout.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zingiri Web Shop | =2.4.0 | |
| WordPress |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://plugins.trac.wordpress.org/changeset?reponame=&old=537613%40zingiri-web-shop&new=537613%40zingiri-web-shop
- http://secunia.com/advisories/48991
- http://wordpress.org/extend/plugins/zingiri-web-shop/changelog/
- http://www.exploit-db.com/exploits/18787
- http://www.osvdb.org/81492
- http://www.osvdb.org/81493
- http://www.securityfocus.com/bid/53278
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75178
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75179
Frequently Asked Questions
What is the severity of CVE-2012-6506?
CVE-2012-6506 is classified as a high severity vulnerability due to its potential for remote code execution via cross-site scripting.
How do I fix CVE-2012-6506?
To fix CVE-2012-6506, update the Zingiri Web Shop plugin to a version that addresses the cross-site scripting vulnerabilities.
Which versions of Zingiri Web Shop are affected by CVE-2012-6506?
CVE-2012-6506 specifically affects version 2.4.0 of the Zingiri Web Shop plugin.
Is WordPress itself vulnerable in CVE-2012-6506?
No, CVE-2012-6506 is not a vulnerability within WordPress itself but rather in the Zingiri Web Shop plugin.
What is cross-site scripting (XSS) as it relates to CVE-2012-6506?
Cross-site scripting (XSS) in CVE-2012-6506 occurs when an attacker injects malicious scripts into web pages viewed by users, compromising the security of the application.
- agent/type
- agent/author
- agent/references
- agent/severity
- agent/remedy
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/weakness
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/zingiri
- canonical/zingiri web shop
- version/zingiri web shop/2.4.0
- vendor/wordpress
- canonical/wordpress