CVE:CVE-2016-10920
CNNVD:CNNVD-201908-1769
WordPress是WordPress基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。gnucommerce是使用在其中的一个电子商务插件。
WordPress gnucommerce插件0.5.7-BETA之前版本中存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。
solution:Upgrade sir gnucommerce to a higher version than 0.1:beta,0.1.4:beta,0.2.1:beta,0.2.2:beta,0.2.3:beta,0.2.4:beta,0.2.5:beta,0.2.7:beta,0.2.8:beta,0.2.9:beta,0.3.0:beta,0.3.1:beta,0.3.2:beta,0.3.3:beta,0.3.4:beta,0.3.6:beta,0.3.7:beta,0.3.8:beta,0.4.0:beta,0.4.1:beta,0.4.2:beta,0.4.3:beta,0.4.5:beta,0.4.6:beta,0.5.0:beta,0.5.1:beta,0.5.2:beta,0.5.4:beta,0.5.5:beta,and avoid the version 0.1:beta,0.1.4:beta,0.2.1:beta,0.2.2:beta,0.2.3:beta,0.2.4:beta,0.2.5:beta,0.2.7:beta,0.2.8:beta,0.2.9:beta,0.3.0:beta,0.3.1:beta,0.3.2:beta,0.3.3:beta,0.3.4:beta,0.3.6:beta,0.3.7:beta,0.3.8:beta,0.4.0:beta,0.4.1:beta,0.4.2:beta,0.4.3:beta,0.4.5:beta,0.4.6:beta,0.5.0:beta,0.5.1:beta,0.5.2:beta,0.5.4:beta,0.5.5:beta