This host is installed with Wordpress W3 Total Cache and is prone to cross site scripting vulnerability.

Successful exploitation will allow remote attackers to execute arbitrary HTML and script code in a users browser session in the context of an affected site. Impact Level: Application

Upgrade to version 0.9.4.1 or higher, For updates refer https://wordpress.org/plugins/w3-total-cache

Flaw is due to improper validation of input that contains the Cache Key and is passed via the URL before returning it to users.

Wordpress W3 Total Cache version before 0.9.4.1

Send a crafted data via HTTP GET request and check whether it is able to read cookie or not.

• http://packetstormsecurity.com/files/129626
• https://wpvulndb.com/vulnerabilities/7718
• https://www.secuvera.de/advisories/secuvera-SA-2014-01.txt

---

Updated on 2015-03-25