CVE-2014-8492: XSS
Published Oct 6, 2017
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) sitename, (2) message, or (3) siteurl parameter.
Affected Software
1 affected component
Cozmoslabs Profile Builder Wordpress<=2.0.2
Event History
Oct 6, 2017
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-8492?
CVE-2014-8492 is classified as a moderate severity vulnerability allowing cross-site scripting (XSS) attacks.
2
How do I fix CVE-2014-8492?
To fix CVE-2014-8492, update the Profile Builder plugin to version 2.0.3 or later.
3
What parameters are affected by CVE-2014-8492?
The parameters affected by CVE-2014-8492 are site_name, message, and site_url.
4
Can CVE-2014-8492 be exploited remotely?
Yes, CVE-2014-8492 can be exploited remotely by attackers to inject arbitrary scripts.
5
Which version of the Profile Builder plugin is vulnerable to CVE-2014-8492?
Versions of the Profile Builder plugin prior to 2.0.3 are vulnerable to CVE-2014-8492.