Cross-site scripting (XSS) in eShop plugin for WordPress - CVE-2016-0765

Detailed vulnerability description

Vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability is caused by an input validation error in eshop-orders.php in the eShop plugin 6.3.14 for WordPress when processing the "page" or "action" parameters. A remote attacker can trick the victim to follow a specially specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

How to mitigate CVE-2016-0765

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Sources

• http://www.openwall.com/lists/oss-security/2016/02/02/3
• http://www.vapid.dhs.org/advisory.php?v=160