CVE-2014-4524 – WP Easy Post Types < 1.4.4 - Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2014-4524

Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ref parameter. Vulnerabilidad de XSS en classes/custom-image/media.php en el plugin WP Easy Post Types anterior a 1.4.4 para WordPress permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro ref. The WP Easy Post Types plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ref' parameter found in the classes/custom-image/media.php file in versions up to 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • http://codevigilant.com/disclosure/wp-plugin-easy-post-types-a3-cross-site-scripting-xss http://wordpress.org/plugins/easy-post-types/changelog https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=842687%40easy-post-types&old=806912%40easy-post-types&sfp_email=&sfph_mail= • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •