Login Request a demo
Unscored severity · published Mar 12, 2014
CVE-2013-1636
Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link Lite plugin before 1.6.3 for WordPress,…
–
CVSS
6.3%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link Lite plugin before 1.6.3 for WordPress, JNews (com_jnews) component 8.0.1 for Joomla!, and CiviCRM 3.1.0 through 4.2.9 and 4.3.0 through 4.3.3, allows remote attackers to inject arbitrary web script or HTML via the get-data parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.3% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
Civicrm · Civicrm
3.1.0; 3.1.1; 3.1.2; 3.1.3; 3.1.4; 3.1.5; +34 more · source: NVD
CJ
Com Jnews · Joobi
8.0.1 · source: NVD
PR
Prettylinks · Caseproof
through 1.6.2; 1.6.0; 1.6.1 · source: NVD
Affected product
PR
Prettylinks
Caseproof
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1636
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1636
Exploit
http://archives.neohapsis.com/archives/bugtraq/2013-02/0101.html
osvdb.org
http://osvdb.org/90435
packetstormsecurity.com
http://packetstormsecurity.com/files/120433/WordPress-Pretty-Link-1.6.3-Cross-Site-Scripting.html
packetstormsecurity.com
http://packetstormsecurity.com/files/121623/Joomla-Jnews-8.0.1-Cross-Site-Scripting.html
wordpress.org
http://wordpress.org/plugins/pretty-link/changelog
Patch
https://civicrm.org/advisory/civi-sa-2013-002-openflashchart-xss
More from Prettylinks
7.2
CVE-2015-9457
The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::list_links SQL injection via the group parameter
6.1
CVE-2011-4595
Pretty-Link WordPress plugin 1.5.2 has XSS
4.3
CVE-2024-2326
The Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and…