CVE-2011-4955

MediumCVSS 6.1/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in ui_stats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s or (2) p parameters to index.php.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://plugins.trac.wordpress.org/changeset?old_path=%2Fbsuite&old=520611&new_path=%2Fbsuite&new=520611Broken Link
http://secunia.com/advisories/45234Permissions Required
http://wordpress.org/support/topic/plugin-bsuite-xss-security-vulnerability-in-407Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/04/16/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/04/16/8Mailing List, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/68602Third Party Advisory, VDB Entry
http://plugins.trac.wordpress.org/changeset?old_path=%2Fbsuite&old=520611&new_path=%2Fbsuite&new=520611Broken Link
http://secunia.com/advisories/45234Permissions Required
http://wordpress.org/support/topic/plugin-bsuite-xss-security-vulnerability-in-407Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/04/16/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/04/16/8Mailing List, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/68602Third Party Advisory, VDB Entry

Timeline

Published: Dec 20, 2017
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-49564.3Cross-site scripting (XSS) vulnerability in WordPress before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspec CVE-2011-49575.0The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the CVE-2011-49584.3Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows CVE-2011-49596.8SQL injection vulnerability in the addslashes method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6, when connected to a MySQL d CVE-2011-49607.5SQL injection vulnerability in the Folder::findOrMake method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote attack CVE-2011-49616.0SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote authenticated users with the EDIT_PERMISSIONS permission to gain admin CVE-2011-49626.8code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a c CVE-2011-49635.0nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers to bypass intended access restrictions and access restricted CVE-2011-49666.0modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the passw CVE-2011-49677.5tog-Pegasus has a package hash collision DoS vulnerability CVE-2011-49684.8nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM)CVE-2011-49694.3Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inj