WordPress Plugin Vulnerabilities

Motors Car Dealer & Classified Ads < 1.4.1 - Multiple Issues

Description

- Unauthenticated plugin's settings import/export (leading to stored XSS)
- Authenticated settings import
- Unsanitised inputs
- Authenticated options change

Affects Plugins

Plugin icon
motors-car-dealership-classified-listings
Fixed in 1.4.1

References

CVE
CVE-2019-17228
CVE
CVE-2019-17229
URL
https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-motors-car-dealer-classified-ads-plugin/

Miscellaneous

Original Researcher
Jerome Bruandet
Verified
No
WPVDB ID
27799579-31d4-4d05-aa5f-6542061e56e4

Timeline

Publicly Published
2019-09-20 (about 6 years ago)
Added
2019-09-20 (about 6 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2019-08-02
Title
Woody Ad Snippets < 2.2.5 - Multiple issues leading to RCE
Published
2014-12-09
Title
PWG R&om <= 1.11 - CSRF & XSS
Published
2019-07-08
Title
WP Slimstat <= 4.8.3 - CSRF to Stored XSS and Setting Updates
Published
2014-08-01
Title
Flash News - Multiple Vulnerabilities
Published
2017-02-23
Title
Democracy Poll < 5.4 - CSRF & XSS