What the vulnerability does
01Description
A vulnerability was found in Mark User as Spammer Plugin 1.0.0/1.0.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function user_row_actions of the file plugin/plugin.php. The manipulation of the argument url leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is e7059727274d2767c240c55c02c163eaa4ba6c62. It is recommended to upgrade the affected component. The identifier VDB-222325 was assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The Mark User as Spammer plugin contains a cross-site scripting (XSS) vulnerability that allows a low-privileged user to inject malicious scripts. An attacker must trick a site administrator into visiting a crafted link. The injected code executes in the admin's browser, potentially allowing unauthorized actions within the WordPress admin panel.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that runs in an admin's browser when they visit a crafted link.
Potential impact on your site
04Site Impact
An attacker with a user account can trick admins into executing malicious actions via their browser session.
Conditions required to exploit
05Prerequisites
Low-level user account on the site; admin must click the attacker's link or visit a page containing the payload.
Key dates
06Disclosure timeline
March 6, 2023
CVE published
August 6, 2024
Record updated
