LocalWeb All In One, c8069655-fc7b-4b97-b871-45705260fb1b
- CVE, Research URL
- Home page URL
- Application
- Published on
- -
- Research Description
- LocalWeb All In One [lw-all-in-one] < 1.6.5 LocalWeb All In One plugin < 1.6.5 - Unauthenticated Stored Cross-Site Scripting (XSS) An Unauthenticated Stored XSS vulnerability was discovered in the LocalWeb All In One plugin v1.6.3 for WordPress. There is an older version of this plugin called Web Instant Messenger, latest version is v1.1.1. The specificity of this plugin is that it interacts with the remote host www.localweb.it, so the payload will be executed on it.
- Affected versions
-
max 1.6.5.
- Status
-
vulnerable