CVE-2018-1000556 Cross-site scripting in n/a

What is CVE-2018-1000556?

CVE-2018-1000556 is a medium-severity cross-site scripting vulnerability in n/a, published on 26 Jun 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be exploitable via an attacker must craft an URL with payload and send to the user. Victim need to open the link to be affected by reflected XSS. .

Weakness: CWE-79

Which versions are affected by CVE-2018-1000556?

It affects 1 product.

Products include Veronalabs Wp Statistics.

How do I fix CVE-2018-1000556?

No fix has been published for CVE-2018-1000556 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2018-1000556 being exploited?

There is no known exploitation of CVE-2018-1000556 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-38074 WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL Injection Critical 9.9
• CVE-2022-0651 WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type Critical 9.8
• CVE-2022-25148 WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id Critical 9.8
• CVE-2022-25149 WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP Critical 9.8
• CVE-2022-0513 WP Statistics <= 13.1.4 Unauthenticated Blind SQL Injection via exclusion_reason Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j36q-jx34-3frw, UBUNTU-CVE-2018-1000556.