Description

WordPress Plugin TinyMCE Color Picker is prone to multiple vulnerabilities, including cross-site request forgery and security bypass vulnerabilities. Exploiting these issues may allow an attacker to perform otherwise restricted actions and subsequently e.g. manipulate plugin settings. WordPress Plugin TinyMCE Color Picker version 1.1 is vulnerable.

Remediation

Update to plugin version 1.2 or latest

References

http://secunia.com/advisories/58095/

Related Vulnerabilities

Oracle Database Server CVE-2004-2345 Vulnerability (CVE-2004-2345)

TYPO3 Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-3946)

WordPress Plugin Jetpack-WP Security, Backup, Speed, & Growth Cross-Site Scripting (3.5.2)

Atlassian Confluence Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-18085)

WordPress Plugin Simple Job Board Cross-Site Scripting (2.9.4)

Severity

High

Classification

CVE-2014-3844 CVE-2014-3845 CWE-264 CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update