CVE-2015-2807: XSS
Published Sep 1, 2015
·Updated
Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.
Affected Software
1 affected component
DocumentCloud Navis Documentcloud Wordpress<=0.1
Remediation
Patch Available
Event History
Sep 1, 2015
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-2807?
CVE-2015-2807 is classified as a medium severity vulnerability due to potential exploitation risks via cross-site scripting.
2
How do I fix CVE-2015-2807?
To fix CVE-2015-2807, you should update the Navis DocumentCloud plugin to version 0.1.1 or later.
3
What type of vulnerability is CVE-2015-2807?
CVE-2015-2807 is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject web scripts or HTML.
4
Which software versions are affected by CVE-2015-2807?
CVE-2015-2807 affects the Navis DocumentCloud plugin versions prior to 0.1.1 for WordPress.
5
Can CVE-2015-2807 be exploited remotely?
Yes, CVE-2015-2807 can be exploited remotely by attackers to execute arbitrary scripts in a user's browser.