Unscored severity · published May 21, 2015
CVE-2015-3647
Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin before 6.1.3 for WordPress allow remote attackers to inject…
–
CVSS
2.4%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin before 6.1.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) comemail or (2) comname parameter in a wppa do-comment action.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WP
Wp-photo-album-plus · Wppa.opajaap
through 6.1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-3647
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-3647
Exploit
http://packetstormsecurity.com/files/131976/WordPress-WP-Photo-Album-Plus-6.1.2-Cross-Site-Scripting.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/535575/100/0/threaded
Exploit
http://www.securityfocus.com/bid/74741
Patch
https://wordpress.org/plugins/wp-photo-album-plus/changelog/
Exploit
https://www.htbridge.com/advisory/HTB23257
More from Wp-photo-album-plus
–
CVE-2013-3254
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script…