WordPress Plugin Vulnerabilities

Ldap WP Login / Active Directory Integration < 3.0.2 - Reflected Cross-Site Scripting

Description

The plugin does not escape generated URLs before outputing them in attrubutes, leading to Reflected Cross-Site Scripting

Proof of Concept

Affects Plugins

Plugin icon
ldap-wp-login-integration-with-active-directory
Fixed in 3.0.2

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
WPScan
Verified
Yes
WPVDB ID
1dc2cec8-e3dd-414b-8ccb-d73d51b051ee

Timeline

Publicly Published
2022-09-05 (about 3 years ago)
Added
2022-09-05 (about 3 years ago)
Last Updated
2022-09-05 (about 3 years ago)

Other

Published
Title
Published
2014-08-01
Title
WordPress-to-Lead for Salesforce CRM 1.0 - salesforce.php Multiple Parameter XSS
Published
2019-12-10
Title
Scoutnet Kalender <= 1.1.0 - Stored Cross-Site Scripting (XSS)
Published
2021-12-13
Title
Out of the Box < 1.20.3 - Reflected Cross-Site Scripting
Published
2025-08-26
Title
SiteSEO – SEO Simplified < 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Broken Regex Expression
Published
2023-11-28
Title
JetBlocks For Elementor < 1.3.8.1 - Reflected Cross Site Scripting