LiveActive security incident?Get immediate response
CVE Record

CVE-2015-10093: Mark User as Spammer Plugin plugin.php user_row_actions cross site scripting

A vulnerability was found in Mark User as Spammer Plugin 1.0.0/1.0.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function user_row_actions of the file plugin/plugin.php. The manipulation of the argument url leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is e7059727274d2767c240c55c02c163eaa4ba6c62. It is recommended to upgrade the affected component. The identifier VDB-222325 was assigned to this vulnerability.

LowCVSS 2.6Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a low-severity cross-site scripting issue in the WordPress Mark User as Spammer Plugin. It affects versions 1.0.0 and 1.0.1. Successful exploitation appears difficult and requires user interaction, but it could let an authenticated attacker influence page content or actions in a limited way.

Executive priority

Treat this as routine maintenance unless the plugin is deployed on sensitive WordPress sites with many authenticated users. The documented impact is limited, but upgrading is straightforward and should be included in the next plugin patch cycle.

Technical view

The reported flaw is CWE-79 in plugin/plugin.php, specifically the user_row_actions function. Manipulation of the url argument can lead to XSS. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N, scoring 2.6. Version 1.0.2 contains the referenced fix.

Likely exposure

Exposure is limited to WordPress sites running Mark User as Spammer Plugin versions 1.0.0 or 1.0.1. The source data does not identify broader affected products or hosted services.

Exploitation context

The bundle reports remote attackability but high attack complexity, required low privileges, and required user interaction. KEV status is false, and the provided sources do not support a claim of active exploitation.

Researcher notes

Evidence is strongest for affected versions, CVSS attributes, CWE-79 classification, and the fixed release. The provided bundle does not include proof of active exploitation, exploit maturity, or detailed environmental preconditions beyond the CVSS vector.

Mitigation direction

  • Upgrade Mark User as Spammer Plugin to version 1.0.2.
  • Confirm the deployed plugin release includes patch e7059727274d2767c240c55c02c163eaa4ba6c62.
  • Prioritize sites where untrusted users can authenticate to WordPress.
  • If upgrade timing is uncertain, check vendor guidance before applying compensating controls.

Validation and detection

  • Inventory WordPress installations for Mark User as Spammer Plugin.
  • Confirm no site is running plugin version 1.0.0 or 1.0.1.
  • Verify updated installations report version 1.0.2.
  • Review relevant WordPress admin activity for unexpected user-row action behavior.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2015-10093 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
2.6 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
2.6CVSS 3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N1.21.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

2.6Low
CVSS 3.1 vector shape for CVE-2015-10093Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aMark User as Spammer Plugin1.0.0, 1.0.1Listed
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-79 · source CWE mapping

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs