Pligg is prone to multiple cross-site scripting vulnerabilities and a cross-site request-forgery vulnerability. An attacker can exploit these issues to steal cookie-based authentication credentials or perform unauthorized actions when masquerading as the victim. Other attacks are also possible. Versions prior to Pligg 1.0.3 are vulnerable.

Vendor updates are available. Please see the references for details.

• http://holisticinfosec.org/content/view/130/45/
• http://www.pligg.com/
• http://www.pligg.com/blog/775/pligg-cms-1-0-3-release/
• http://www.securityfocus.com/bid/37185

---

Updated on 2015-03-25