CVE-2012-2920

Published: May 21, 2012Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the userphoto_options_page function in user-photo.php in the User Photo plugin before 0.9.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to wp-admin/options-general.php. NOTE: some of these details are obtained from third party information.

Affected (19)

Products: User Photo: User Photo

User Photo

1 product

User Photo

Configuration A

19 vulnerable · 1 platform

Vulnerable Software	Affected Versions
User Photo User Photo	Up to 0.9.5
User Photo User Photo	Version 0.7.0.1
User Photo User Photo	Version 0.7.1
User Photo User Photo	Version 0.7.2
User Photo User Photo	Version 0.7.3
User Photo User Photo	Version 0.7.4
User Photo User Photo	Version 0.7.4b
User Photo User Photo	Version 0.8.0.1
User Photo User Photo	Version 0.8.0.2
User Photo User Photo	Version 0.8.0.3
User Photo User Photo	Version 0.8.0.4
User Photo User Photo	Version 0.8.0.5
User Photo User Photo	Version 0.8.1
User Photo User Photo	Version 0.8
User Photo User Photo	Version 0.9.1
User Photo User Photo	Version 0.9.2
User Photo User Photo	Version 0.9.3
User Photo User Photo	Version 0.9.4
User Photo User Photo	Version 0.9