Description

WordPress Plugin TinyMCE Color Picker is prone to multiple vulnerabilities, including cross-site request forgery and security bypass vulnerabilities. Exploiting these issues may allow an attacker to perform otherwise restricted actions and subsequently e.g. manipulate plugin settings. WordPress Plugin TinyMCE Color Picker version 1.1 is vulnerable.

Remediation

Update to plugin version 1.2 or latest

References

http://secunia.com/advisories/58095/

Related Vulnerabilities

WordPress Plugin WP Support Plus Responsive Ticket System Cross-Site Scripting (9.1.1)

WordPress 4.5.x Multiple Vulnerabilities (4.5 - 4.5.26)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-21029)

WordPress Plugin Booster for WooCommerce Multiple Cross-Site Request Forgery Vulnerabilities (6.0.0)

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2007-5596)

Severity

High

Classification

CVE-2014-3844 CVE-2014-3845 CWE-264 CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update