Description

Vanilla before 2.6.1 allows XSS via the email field of a profile.

Remediation

References

CVE-2018-17571

Related Vulnerabilities

DOMPurify URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2019-25155)

axios Origin Validation Error Vulnerability (CVE-2024-57965)

WordPress Plugin WebEngage Feedback, Survey and Notification Cross-Site Scripting (2.0.0)

Zenphoto Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2012-0993)

WordPress 4.7.x Multiple Vulnerabilities (4.7 - 4.7.19)

Severity

Medium

Classification

CVE-2018-17571 CWE-707 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities