CVE-2013-1409 : Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4

Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _ajax_nonce parameter to wp-admin/admin-ajax.php.

Published 2014-03-03 16:55:04

Updated 2014-03-04 16:11:31

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2013-1409

Commentluv » Commentluv » For Wordpress
Versions up to, including, (<=) 2.92.3
cpe:2.3:a:commentluv:commentluv:*:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.9.9 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.9.9:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.9.8 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.9.8:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.9.7 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.9.7:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.9.6 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.9.6:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.3 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.3:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.1 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.1:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.81.8 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.81.8:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.81.7 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.81.7:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.765 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.765:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.764 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.764:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.91 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.91:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.9.9.2 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.9.9.2:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.9.4 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.9.4:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.9.2 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.9.2:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.7 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.7:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.5 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.5:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.81.6 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.81.6:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.81.4 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.81.4:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.769 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.769:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.767 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.767:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.76 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.76:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.71 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.71:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.763 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.763:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.762 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.762:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.92.2 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.92.2:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.92.1 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.92.1:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.92 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.92:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.91.1 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.91.1:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.9 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.9:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.8.3 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.8.3:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.8.2 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.8.2:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.8.1 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.8.1:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.81.2 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.81.2:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.81.1 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.81.1:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.81 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.81:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.80 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.80:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.7 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.7:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.9.9.3 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.9.9.3:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.9.9.1 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.9.9.1:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.9.5 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.9.5:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.9.3 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.9.3:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.9.1 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.9.1:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.8 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.8:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.90.6 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.90.6:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.81.5 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.81.5:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.81.3 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.81.3:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.7691 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.7691:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.768 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.768:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.766 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.766:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.761 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.761:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Commentluv » Commentluv » Version: 2.74 For Wordpress
cpe:2.3:a:commentluv:commentluv:2.74:*:*:*:*:wordpress:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2013-1409

EPSS FAQ

3.23%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 92 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2013-1409

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2013-1409

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-1409

http://archives.neohapsis.com/archives/bugtraq/2013-02/0031.html

Exploit
https://www.htbridge.com/advisory/HTB23138

Cross-Site Scripting (XSS) Vulnerability in CommentLuv WordPress Plugin - HTB23138 Security Advisory | ImmuniWeb
Exploit
http://packetstormsecurity.com/files/120090/WordPress-CommentLuv-2.92.3-Cross-Site-Scripting.html

WordPress CommentLuv 2.92.3 Cross Site Scripting ≈ Packet Storm
Exploit
http://wordpress.org/plugins/commentluv/changelog

CommentLuv – WordPress plugin | WordPress.org

Jump to

Vulnerability Details : CVE-2013-1409

Products affected by CVE-2013-1409

Exploit prediction scoring system (EPSS) score for CVE-2013-1409

CVSS scores for CVE-2013-1409

CWE ids for CVE-2013-1409

References for CVE-2013-1409