Cross-site scripting (XSS) vulnerability in the userphoto_options_page function in user-photo.php in the User Photo plugin before 0.9.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to wp-admin/options-general.php. NOTE: some of these details are obtained from third party information.
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-79,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| user_photo | user_photo | 0.7.3 |
| user_photo | user_photo | 0.7.2 |
| user_photo | user_photo | 0.7.4 |
| user_photo | user_photo | 0.8.0.1 |
| user_photo | user_photo | 0.9 |
| user_photo | user_photo | 0.9.4 |
| user_photo | user_photo | 0.7.4b |
| user_photo | user_photo | 0.8 |
| user_photo | user_photo | * |
| user_photo | user_photo | 0.9.2 |
| user_photo | user_photo | 0.8.1 |
| user_photo | user_photo | 0.9.1 |
| user_photo | user_photo | 0.8.0.2 |
| user_photo | user_photo | 0.7.1 |
| user_photo | user_photo | 0.8.0.3 |
| user_photo | user_photo | 0.8.0.5 |
| user_photo | user_photo | 0.7.0.1 |
| user_photo | user_photo | 0.9.3 |
| user_photo | user_photo | 0.8.0.4 |