CVE-2014-4602 – XEN Carousel <= 0.12.2 - Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2014-4602

Multiple cross-site scripting (XSS) vulnerabilities in xencarousel-admin.js.php in the XEN Carousel plugin 0.12.2 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) path or (2) ajaxpath parameter. Múltiples vulnerabilidades de XSS en xencarousel-admin.js.php en el plugin XEN Carousel 0.12.2 y anteriores para WordPress permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro (1) path o (2) ajaxpath. • http://codevigilant.com/disclosure/wp-plugin-xen-carousel-a3-cross-site-scripting-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •