// For flags

CVE-2017-15375

WPJobBoard <= 4.5.1 - Cross-Site Scripting

Severity Score

6.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Multiple client-side cross site scripting vulnerabilities have been discovered in the WpJobBoard v4.5.1 web-application for WordPress. The vulnerabilities are located in the `query` and `id` parameters of the `wpjb-email`, `wpjb-job`, `wpjb-application`, and `wpjb-membership` modules. Remote attackers are able to inject malicious script code to hijack admin session credentials via the backend, or to manipulate the backend on client-side performed requests. The attack vector is non-persistent and the request method to inject is GET. The attacker does not need a privileged user account to perform a successful exploitation.

Se han descubierto múltiples vulnerabilidades de Cross-Site Scripting (XSS) en el lado del cliente en la aplicación web WpJobBoard v4.5.1 para WordPress. Las vulnerabilidades se encuentran en los parámetros "id" y "query" de los módulos "wpjb-email", "wpjb-job", "wpjb-application", y "wpjb-membership". Los atacantes remotos pueden inyectar código script malicioso para secuestrar credenciales de sesión admin por medio del backend o para manipular el backend en peticiones realizadas en el lado del cliente. El vector de ataque es no persistente y el método de petición para inyectar es GET. El atacante no necesita una cuenta de usuario con privilegios para conseguir una explotación exitosa.

*Credits: Vulnerability Lab
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2017-08-18 CVE Published
  • 2017-10-15 CVE Reserved
  • 2024-09-17 CVE Updated
  • 2024-09-17 First Exploit
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (1)
URL Tag Source
URL Date SRC
https://www.vulnerability-lab.com/get_content.php?id=1941 2024-09-17
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Wpjobboard
Search vendor "Wpjobboard"
 Wpjobboard
Search vendor "Wpjobboard" for product "Wpjobboard"
 4.5.1
Search vendor "Wpjobboard" for product "Wpjobboard" and version "4.5.1"
wordpress
Affected