What is CVE-2018-1000508?

CVE-2018-1000508 is a medium-severity vulnerability in Wpulike Ulike, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2018-06-26.

How severe is CVE-2018-1000508?

Medium severity. CVSS v3 base score is 4.8 out of 10.

Is CVE-2018-1000508 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Wpulike Ulike

CVE-2018-1000508

WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting (XSS) vulnerability in Settings screen that can result in allows unauthorised users to do almost anything an admin can. This attack appear to be exploitable via Admin must visit logs page. This vulnerability appears to have been fixed in 3.2.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.006 (45.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.

Affected products

Wpulike Ulike — versions 2.8.1, 3.1
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

20142995/nuclei-templates

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-1000508?: CVE-2018-1000508 is a medium-severity vulnerability in Wpulike Ulike, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2018-06-26.
How severe is CVE-2018-1000508?: Medium severity. CVSS v3 base score is 4.8 out of 10.
Is CVE-2018-1000508 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.