CVE-2019-15858

admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

18.46% chance of exploitation in the next 30 days, 97th percentile

Nuclei

high

Published

2019-09-03

Updated

2024-08-05

Proof-of-concept exploits (3)

• GeneralEG/CVE-2019-1585832★ · 2023-04-25
• ismail0x01/CVE-20190★ · 2025-04-23
• orangmuda/CVE-2019-158583★ · 2021-10-11

Nuclei templates (1)

• linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/cve-2019-15858-3889.yaml

Security advisories

• https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-woody-ad-snippets-plugi…
• https://wpvulndb.com/vulnerabilities/9490

References

• CVE Record
• NVD entry

Related

• CVE-2018-15961
• CVE-2020-0796
• CVE-2021-20837
• CVE-2021-21972
• CVE-2021-22893
• CVE-2021-26084