CVE-2012-6622

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-01-16 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) groupid parameter in an editgroup action or (2) usergroup_id parameter in an edit_usergroup action.

Affected products

Vasthtml Forumpress: through 1.7.4; 1.0, 1.1, 1.2, 1.3, 1.4, 1.5 (+15)

References

http://packetstormsecurity.org/files/112703/WordPress-WP-Forum-Server-1.7.3-SQL-Injection-Cross-Site-Scripting.html
http://secunia.com/advisories/49155
http://wordpress.org/extend/plugins/forum-server/changelog/
http://www.securityfocus.com/bid/53530
https://plugins.trac.wordpress.org/changeset/532918
http://packetstormsecurity.org/files/112703/WordPress-WP-Forum-Server-1.7.3-SQL-Injection-Cross-Site-Scripting.html
http://secunia.com/advisories/49155
http://wordpress.org/extend/plugins/forum-server/changelog/
http://www.securityfocus.com/bid/53530
https://plugins.trac.wordpress.org/changeset/532918

Get alerted when CVE-2012-6622 or the next vulnerability affects your stack