Security readout for executives and security teams
Plain-English summary
CVE-2015-10094 is a low-severity cross-site scripting issue in the WordPress Fastly Plugin through version 0.97. An authenticated remote attacker could manipulate a URL argument in lib/api.php and affect page integrity. The documented fix is upgrading to version 0.98.
Executive priority
Handle in normal patch cadence unless the plugin is deployed on sensitive or heavily administered WordPress sites. The issue affects integrity rather than confidentiality or availability, requires authentication, and has a documented upgrade path.
Technical view
The flaw is CWE-79 in the post function of lib/api.php, where the url argument can lead to cross-site scripting. Sources rate it CVSS v2 3.3 with AV:N/AC:L/Au:M/C:N/I:P/A:N. Version 0.98 and commit d7fe42538f4d4af500e3af9678b6b06fba731656 address it.
Likely exposure
Exposure is limited to WordPress sites running Fastly Plugin versions 0.1 through 0.97. The CVSS vector indicates remote network reachability but authenticated access is required. Public-facing WordPress administration or plugin API surfaces may increase practical concern.
Exploitation context
The source bundle says the attack may be launched remotely and requires authentication per CVSS. It is not listed in KEV, and no provided source states active exploitation. Treat exploitation evidence as unconfirmed.
Researcher notes
Focus review on installed plugin versions, authenticated exposure, and whether the lib/api.php post handler is reachable in the local deployment. Public evidence supports XSS classification and a patch, but does not establish active exploitation or broader product impact.
Mitigation direction
- Upgrade the Fastly Plugin to version 0.98 or later.
- Confirm the deployed package includes patch d7fe42538f4d4af500e3af9678b6b06fba731656.
- Restrict WordPress administrative access to trusted users.
- Monitor vendor and WordPress plugin guidance for any newer remediation notes.
Validation and detection
- Inventory WordPress sites for the Fastly Plugin and installed version.
- Verify no deployed site runs versions 0.1 through 0.97.
- Review plugin files or release metadata for the documented patch.
- Check security logs for unusual authenticated plugin API activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2015-10094 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.3 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:M/C:N/I:P/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:M/C:N/I:P/A:N6.42.9Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
3.3LowVector: AV:N/AC:L/Au:M/C:N/I:P/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://vuldb.com/?id.222326CVE reference · vdb-entry, technical-description
- https://vuldb.com/?ctiid.222326CVE reference · signature, permissions-required
- https://github.com/wp-plugins/fastly/commit/d7fe42538f4d4af500e3af9678b6b06fba731656CVE reference · patch
- https://github.com/wp-plugins/fastly/releases/tag/0.98CVE reference · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.