Vulnerability Description
Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the iusib_meta_fields parameter.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Improved User Search In Backend Project | Improved User Search In Backend | <= 1.2.4 |
Related Weaknesses (CWE)
References
- http://secunia.com/advisories/60590
- http://wordpress.org/plugins/improved-user-search-in-backend/changelogPatchVendor Advisory
- https://security.dxw.com/advisories/csrf-and-xss-in-improved-user-search-allow-eExploit
- http://secunia.com/advisories/60590
- http://wordpress.org/plugins/improved-user-search-in-backend/changelogPatchVendor Advisory
- https://security.dxw.com/advisories/csrf-and-xss-in-improved-user-search-allow-eExploit
FAQ
What is CVE-2014-5196?
CVE-2014-5196 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers t...
How severe is CVE-2014-5196?
CVE-2014-5196 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-5196?
Check the references section above for vendor advisories and patch information. Affected products include: Improved User Search In Backend Project Improved User Search In Backend.