WordPress Plugin Vulnerabilities

WP Whois Domain <= 1.0.0 - Unauthenticated Cross-Site Scripting (XSS)

Description

The plugin is still affected and has been closed.

Proof of Concept

Affects Plugins

Plugin icon
wp-whois-domain
No known fix

References

CVE
CVE-2017-18612
URL
https://rastating.github.io/wp-whois-domain-reflected-xss/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
ce179c5b-db60-465c-a359-db2522d5135a

Timeline

Publicly Published
2016-11-28 (about 9 years ago)
Added
2016-12-01 (about 9 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2014-08-01
Title
ThinkIT <= 0.2 - wp-admin/admin.php toitcf_current_id Parameter XSS
Published
2023-05-10
Title
WP Chinese Conversion <= 1.1.16 - Reflected XSS
Published
2025-09-10
Title
ThemeLoom Widgets <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-08-27
Title
WP Thumbtack Review Slider < 2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-07-26
Title
Happy Addons for Elementor < 3.11.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via PDF View Widget