CVE-2019-15858
high · 8.8A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.
8.8
CVSS
18.5%
EPSS (exploit prob.)
97th
EPSS percentile
2019-09-03
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-306
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| webcraftic | woody_ad_snippets | < 2.2.5 |
Check a specific version with /api/v1/cve/match.
References
- https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-woody-ad-snippets-plugin-lead-to-remote-code-execution/
- https://wpvulndb.com/vulnerabilities/9490
- https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-woody-ad-snippets-plugin-lead-to-remote-code-execution/
- https://wpvulndb.com/vulnerabilities/9490
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2019-15858