Description

WordPress Plugin Vitamin is prone to multiple arbitrary file disclosure vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to view local files in the context of the web server process, which may aid in launching further attacks. WordPress Plugin Vitamin version 1.0.0 is vulnerable.

Remediation

Update to plugin version 1.1.0 or latest

References

http://secunia.com/advisories/50176/

http://www.securityfocus.com/bid/54856/

Related Vulnerabilities

WordPress Plugin NextGEN Pro Cross-Site Scripting (3.1.9)

WordPress Plugin User Profile Builder-Beautiful User Registration Forms, User Profiles & User Role Editor Privilege Escalation (2.4.0)

WordPress Plugin WP Hotel Booking Cross-Site Request Forgery (1.10.1)

WordPress Plugin Titan Framework Cross-Site Scripting (1.7.5)

Mailman Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2020-15011)

Severity

High

Classification

CVE-2012-6651 CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Information Disclosure