Description

WordPress Plugin Comment System for WordPress & Ajax Comments-Comment Press is prone to a cross-frame scripting vulnerability. Exploiting this issue may allow a remote attacker to steal user credentials from an unsuspecting user. This attack is usually successful only when combined with social engineering. WordPress Plugin Comment System for WordPress & Ajax Comments-Comment Press version 2.7.0 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 2.7.2 or latest

References

https://ex-mi.ru/exploit/[2020-08-28]-[WordPress]-comment-press-plugin-v2.7.0.txt

https://codecanyon.net/item/commentpress-ajax-comments-insert-edit-and-delete-comments-for-wp/4542951

Related Vulnerabilities

WebLogic Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') Vulnerability (CVE-2018-1000613)

WordPress Plugin Popup Maker-Popup for opt-ins, lead gen, & more Cross-Site Scripting (1.16.4)

Oracle Database Server CVE-2024-21251 Vulnerability (CVE-2024-21251)

Plone CMS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-7060)

WordPress Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2014-5204)

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update