Microweber vulnerable to cross-site scripting (XSS)
The advisory, in context
Microweber is a drag and drop website builder and a powerful next generation CMS. Microweber versions 1.2.15 and prior are vulnerable to cross-site scripting. This could lead to injection of arbitrary JaveScript code, defacement of a page, or stealing cookies. A patch is available on the master branch of Microweber's GitHub repository.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases through 1.2.15 (inclusive)
No fix recorded for this interval.
24 explicitly affected versions
0.9.346, 0.93, 0.931, 0.934, 0.951, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.1, v1.2.10, v1.2.11, v1.2.12, v1.2.13, v1.2.14, v1.2.15, v1.2.3, v1.2.4, v1.2.5, v1.2.6, v1.2.7, v1.2.8, v1.2.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.2.15"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.9.346",
"0.93",
"0.931",
"0.934",
"0.951",
"1.0.3",
"1.0.4",
"1.0.5",
"1.0.6",
"1.0.7",
"1.1",
"v1.2.10",
"v1.2.11",
"v1.2.12",
"v1.2.13",
"v1.2.14",
"v1.2.15",
"v1.2.3",
"v1.2.4",
"v1.2.5",
"v1.2.6",
"v1.2.7",
"v1.2.8",
"v1.2.9"
]
}