CVE-2019-11869

The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (it actually only verifies that the request is for an admin page). An unauthenticated attacker can inject a payload into the plugin settings, such as the yuzo_related_post_css_and_style setting.

CVSS v3.0

6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

5.33% chance of exploitation in the next 30 days, 92th percentile

Nuclei

medium · CWE-79

Published

2019-05-09

Updated

2024-08-04

Proof-of-concept exploits (2)

• https://www.wordfence.com/blog/2019/04/yuzo-related-posts-zero-day-vulnerability-exploite…
• gitrecon1455/CVE-2019-118690★ · 2024-11-14

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11869.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2019-11846
• CVE-2019-11875
• CVE-2019-11845
• CVE-2019-11878
• CVE-2019-11841
• CVE-2019-11881