CVE-2019-13463: XSS

Q: What is CVE-2019-13463?

CVE-2019-13463 is an XSS vulnerability in the Simple Link Directory plugin before version 7.3.5 for WordPress.

Q: How does CVE-2019-13463 allow remote attackers to inject arbitrary web script or HTML?

CVE-2019-13463 allows remote attackers to inject arbitrary web script or HTML by not calling esc_html for the "echo get_the_title()" or "echo $term->name" statement in qcopd-shortcode-generator.php.

Published Mar 20, 2020

Updated

An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML, because eschtml is not called for the "echo getthetitle()" or "echo $term->name" statement.

Affected Software

1 affected component

QuantumCloud Simple Link Directory Wordpress<7.3.5

Remediation

Patch Available

https://plugins.trac.wordpress.org/changeset?old_path=%2Fsimple-link-directory&old=2111131&new_path=%2Fsimple-link-directory&new=2111132&sfp_email=&sfph_mail=

Event History

Mar 20, 2020

CVE Published

via MITRE·08:40 PM

Data Sourced

via MITRE·08:40 PM

Description

Frequently Asked Questions

What is CVE-2019-13463?

CVE-2019-13463 is an XSS vulnerability in the Simple Link Directory plugin before version 7.3.5 for WordPress.

How does CVE-2019-13463 allow remote attackers to inject arbitrary web script or HTML?

CVE-2019-13463 allows remote attackers to inject arbitrary web script or HTML by not calling esc_html for the "echo get_the_title()" or "echo $term->name" statement in qcopd-shortcode-generator.php.

What is the severity of CVE-2019-13463?

The severity of CVE-2019-13463 is medium (CVSS score: 6.1).

Which versions of the Simple Link Directory plugin for WordPress are affected by CVE-2019-13463?

Versions up to and excluding 7.3.5 of the Simple Link Directory plugin for WordPress are affected by CVE-2019-13463.

How can I fix CVE-2019-13463?

To fix CVE-2019-13463, update the Simple Link Directory plugin to version 7.3.5 or later.