CVE-2014-9570
NONE EPSS 73.0%
Published Jan 15, 201511y ago · Modified Jun 17, 20262w ago
Published Jan 15, 2015 11y ago
Last Modified Jun 17, 2026 2w ago
Description
Multiple cross-site scripting (XSS) vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) datefilter parameter in the access_log page to wp-admin/users.php or (2) simple_security_ip_blacklist[] parameter in an add_blacklist_ip action in the ip_blacklist page to wp-admin/users.php.
Threat Intelligence
EPSS Exploit Probability
73.0% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available
Weaknesses 1
CWE-79 Cross-site Scripting Injection
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| mywebsiteadvisor | simple_security | 1.1.5 | any |
References 2
- securityfocus.com http://www.securityfocus.com/archive/1/534477/100/0/threaded
- htbridge.com https://www.htbridge.com/advisory/HTB23244
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.