music-store Plugin up to 1.0.42 on WordPress admin.php?page=music-store-menu-reports from_year cross site scripting

Summaryinfo

A vulnerability categorized as problematic has been discovered in music-store Plugin up to 1.0.42 on WordPress. This impacts an unknown function of the file wp-admin/admin.php?page=music-store-menu-reports. Executing a manipulation of the argument from_year as part of Parameter can lead to cross site scripting. This vulnerability appears as CVE-2016-10992. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in music-store Plugin up to 1.0.42 on WordPress (WordPress Plugin) and classified as problematic. This vulnerability affects an unknown functionality of the file wp-admin/admin.php?page=music-store-menu-reports. The manipulation of the argument from_year as part of a Parameter leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.

The weakness was presented 09/17/2019. This vulnerability was named CVE-2016-10992 since 09/17/2019. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project.

Upgrading to version 1.0.43 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Name

• music-store Plugin

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15
• 1.0.16
• 1.0.17
• 1.0.18
• 1.0.19
• 1.0.20
• 1.0.21
• 1.0.22
• 1.0.23
• 1.0.24
• 1.0.25
• 1.0.26
• 1.0.27
• 1.0.28
• 1.0.29
• 1.0.30
• 1.0.31
• 1.0.32
• 1.0.33
• 1.0.34
• 1.0.35
• 1.0.36
• 1.0.37
• 1.0.38
• 1.0.39
• 1.0.40
• 1.0.41
• 1.0.42

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion