Unscored severity · published Feb 28, 2008
CVE-2008-1061
Multiple cross-site scripting (XSS) vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1)…
–
CVSS
7.4%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to (a) warning.php, (b) notice.php, and (c) inset.php in view/sniplets/, and possibly (d) modules/execute.php; the (2) url parameter to (e) view/admin/submenu.php; and the (3) page parameter to (f) view/admin/pager.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.4% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Sniplets Plugin · Wordpress
1.1.2; 1.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-1061
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-1061
Vendor Advisory
http://secunia.com/advisories/29099
securityreason.com
http://securityreason.com/securityalert/3706
www.securityfocus.com
http://www.securityfocus.com/archive/1/488734/100/0/threaded
Exploit
http://www.securityfocus.com/bid/27985
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/40830
www.exploit-db.com
https://www.exploit-db.com/exploits/5194
More from Sniplets Plugin
–
CVE-2008-1059
PHP remote file inclusion vulnerability in modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code…
–
CVE-2008-1060
Eval injection vulnerability in modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via the text…