Vulnerability Description
The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant social_widget_icon_array_order XSS.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Acurax | Social Media Widget | <= 3.2.5 |
Related Weaknesses (CWE)
References
- http://lists.openwall.net/full-disclosure/2018/01/10/8ExploitThird Party Advisory
- https://wordpress.org/plugins/acurax-social-media-widget/#developersThird Party Advisory
- http://lists.openwall.net/full-disclosure/2018/01/10/8ExploitThird Party Advisory
- https://wordpress.org/plugins/acurax-social-media-widget/#developersThird Party Advisory
FAQ
What is CVE-2018-6357?
CVE-2018-6357 is a vulnerability with a CVSS score of 8.8 (HIGH). The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with re...
How severe is CVE-2018-6357?
CVE-2018-6357 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-6357?
Check the references section above for vendor advisories and patch information. Affected products include: Acurax Social Media Widget.