CVE-2015-9428

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-09-26 · updated 2026-06-17
Weakness: CWE-352

Description

The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters.

Affected products

wplegalpages Wp Legal Pages: before 1.1 — fixed in 1.1

How to fix

Upgrade to a fixed version: wplegalpages Wp Legal Pages 1.1. Check the vendor advisory for mitigations.

References

http://cinu.pl/research/wp-plugins/mail_4e7cf11876edb93517405b69cb033741.html
https://wordpress.org/plugins/wplegalpages/#developers
https://wpvulndb.com/vulnerabilities/8291
http://cinu.pl/research/wp-plugins/mail_4e7cf11876edb93517405b69cb033741.html
https://wordpress.org/plugins/wplegalpages/#developers
https://wpvulndb.com/vulnerabilities/8291

Get alerted when CVE-2015-9428 or the next vulnerability affects your stack