Description

WordPress Plugin Buddypress Component Stats is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin Buddypress Component Stats version 1.0 is vulnerable.

Remediation

Disable the plugin until a fix is available

References

https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/

Related Vulnerabilities

WordPress Plugin GS Books Showcase Cross-Site Scripting (1.3.0)

WordPress Plugin Dropdown Menu Widget Cross-Site Request Forgery (1.9.1)

Atlassian Confluence Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2023-22527)

WordPress Plugin Social Sharing-Sassy Social Share Cross-Site Scripting (3.3.25)

Jboss EAP Use of a Broken or Risky Cryptographic Algorithm Vulnerability (CVE-2011-2487)

Severity

High

Classification

CVE-2014-2383 CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update File Inclusion