CVE-2014-6243: XSS

Q: What is the severity of CVE-2014-6243?

CVE-2014-6243 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.

Q: How do I fix CVE-2014-6243?

To fix CVE-2014-6243, update the EWWW Image Optimizer plugin to version 2.0.2 or later.

Q: Who is affected by CVE-2014-6243?

CVE-2014-6243 affects users of the EWWW Image Optimizer plugin for WordPress versions prior to 2.0.2.

Q: What kind of attack does CVE-2014-6243 allow?

CVE-2014-6243 allows remote attackers to perform cross-site scripting (XSS) attacks by injecting arbitrary web scripts or HTML.

Q: What is the impact of CVE-2014-6243 on WordPress sites?

The impact of CVE-2014-6243 on WordPress sites includes potential data theft, session hijacking, and malicious script execution.

Published Oct 10, 2014

Updated

Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the error parameter in the ewww-image-optimizer.php page to wp-admin/options-general.php, which is not properly handled in a pngout error message.

Affected Software

2 affected components

Ewww Image Optimizer Plugin Project Ewww Image Optimizer Plugin Wordpress<=2.01

Ewww Image Optimizer Plugin Project Ewww Image Optimizer Plugin Wordpress=2.0.0

Remediation

Patch Available

https://wordpress.org/plugins/ewww-image-optimizer/changelog

Event History

Oct 10, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-6243?

CVE-2014-6243 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2014-6243?