CVE-2011-4618

Published: Jan 24, 2013Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.

Affected (1)

Products: Simplerealtytheme: Advanced Text Widget Plugin

Simplerealtytheme

1 product

Advanced Text Widget Plugin

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Simplerealtytheme Advanced Text Widget Plugin	Up to 2.0.1

Running on/with	Platform Versions
Wordpress Wordpress	All versions

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (16)

http://archives.neohapsis.com/archives/bugtraq/2012-04/0119.html

Source: secalert@redhat.com

Exploit

http://plugins.trac.wordpress.org/changeset?reponame=&new=466102%40advanced-text-widget&old=465828%40advanced-text-widget

Source: secalert@redhat.com

http://wordpress.org/extend/plugins/advanced-text-widget/changelog/

Source: secalert@redhat.com

http://wordpress.org/support/topic/wordpress-advanced-text-widget-plugin-cross-site-scripting-vulnerabilities

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2011/12/19/6

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/520589

Source: secalert@redhat.com

Exploit

http://www.securityfocus.com/bid/50744

Source: secalert@redhat.com

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/71412

Source: secalert@redhat.com

http://archives.neohapsis.com/archives/bugtraq/2012-04/0119.html