CVE-2015-9434 – Logo Carousel < 1.7.2 - Stored Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2015-9434

The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter. El plugin kiwi-logo-carousel versiones anteriores a 1.7.2 para WordPress, presenta una vulnerabilidad de tipo CSRF con un XSS resultante por medio del parámetro tab o tab_flags_order de wp-admin/edit.php?post_type=kwlogos&amp;page=kwlogos_settings. The Logo Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp-admin/edit.php? • http://cinu.pl/research/wp-plugins/mail_3764bb40db5ed12aac2c7812d7544730.html https://wordpress.org/plugins/kiwi-logo-carousel/#developers https://wpvulndb.com/vulnerabilities/8290 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-352: Cross-Site Request Forgery (CSRF) •