The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI.
References
Link | Resource |
---|---|
https://bbpress.org/ | Vendor Advisory |
https://codex.bbpress.org/releases/ | Vendor Advisory |
https://wordpress.org/plugins/bbpress/#developers | Third Party Advisory |
https://www.youtube.com/watch?v=3rXP8CGTe08 | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2020-05-26T13:10:48
Updated: 2020-05-26T13:10:48
Reserved: 2020-05-25T00:00:00
Link: CVE-2020-13487
JSON object: View
NVD Information
Status : Analyzed
Published: 2020-05-26T14:15:13.767
Modified: 2020-05-28T18:28:53.833
Link: CVE-2020-13487
JSON object: View
Redhat Information
No data.
CWE