MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance, 9b248cecab4abd7f6880563d1e52efa6690ccf7e

CVE, Research URL: 9b248cecab4abd7f6880563d1e52efa6690ccf7e
Home page URL: Security reports for MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance
Application: MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance
Published on: Apr 29, 2016
Research Description: MainWP Dashboard: Self-hosted WordPress Management for Agencies [mainwp] < 3.1.3 MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance Plugin <= 3.1.2 - Stored Cross-Site Scripting The MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mwp_setup_purchase_username’ parameter in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 3.1.3.
Status: vulnerable