WordPress Plugin Banners Lite - 'wpbanners_show.php' HTML Injection

Author: Fernando A. Lagos B
type: webapps
platform: php
port: nan
date_added: 2013-03-25 
date_updated: 2015-10-06 
verified: 1 
codes:  
tags: WordPress Plugin
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/58671/info

The Banners Lite plugin for WordPress is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

http://www.example.com/wordpress/wp-content/plugins/wp-banners-lite/wpbanners_show.php?id=1&cid=a_<script>alert(/XSSProof-of-Concept/)</script>