Signature Detail

HTTP: Live Wire WordPress Theme Plugin src Parameter Cross Site Scripting

This signature detects attempts to exploit a cross-site scripting vulnerability in the WordPress Live Wire theme plugin. It is due to insufficient validation of user-supplied input submitted to the src parameter of the thumb.php script. Attackers can steal cookie-based authentication credentials and launch other attacks.

Extended Description

Live Wire for Wordpress is prone to multiple security vulnerabilities. These vulnerabilities include multiple denial-of-service vulnerabilities, a cross-site scripting vulnerability, and an information-disclosure vulnerability. Exploiting these issues could allow an attacker to deny service to legitimate users, gain access to sensitive information, execute arbitrary script code, or steal cookie-based authentication credentials. Other attacks may also be possible. Live Wire for Wordpress 2.3.1 is vulnerable; other versions may also be affected.

Affected Products

• WordPress Live Wire 2.3.1

References

• BugTraq: 47299
• URL: http://www.eblogtemplates.com/live-wire-style-wordpress-theme/