WordPress CVEs

Description

Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414.

Affected WordPress components

• WordPress core
  Confirmed match
  Up to and including 3.3.1; Version 0.71; Version 1.0; Version 1.0.1; Version 1.0.2; Version 1.1.1; Version 1.2; Version 1.2.1; Version 1.2.2; Version 1.2.3; Version 1.2.4; Version 1.2.5; Version 1.3; Version 1.3.2; Version 1.3.3; Version 1.5; Version 1.5.1; Version 1.5.1.1; Version 1.5.1.2; Version 1.5.1.3; Version 1.5.2; Version 2.0; Version 2.0.1; Version 2.0.2; Version 2.0.4; Version 2.0.5; Version 2.0.6; Version 2.0.7; Version 2.0.8; Version 2.0.9; Version 2.0.10; Version 2.0.11; Version 2.1; Version 2.1.1; Version 2.1.2; Version 2.1.3; Version 2.2; Version 2.2.1; Version 2.2.2; Version 2.2.3; Version 2.3; Version 2.3.1; Version 2.3.2; Version 2.3.3; Version 2.5; Version 2.5.1; Version 2.6; Version 2.6.1; Version 2.6.2; Version 2.6.3; Version 2.6.5; Version 2.7; Version 2.7.1; Version 2.8; Version 2.8.1; Version 2.8.2; Version 2.8.3; Version 2.8.4; Version 2.8.5; Version 2.8.5.1; Version 2.8.5.2; Version 2.8.6; Version 2.9; Version 2.9.1; Version 2.9.1.1; Version 2.9.2; Version 3.0; Version 3.0.1; Version 3.0.2; Version 3.0.3; Version 3.0.4; Version 3.0.5; Version 3.0.6; Version 3.1; Version 3.1.1; Version 3.1.2; Version 3.1.3; Version 3.3

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• wordpress wordpress — Up to and including 3.3.1
• wordpress wordpress — Version 0.71
• wordpress wordpress — Version 1.0
• wordpress wordpress — Version 1.0.1
• wordpress wordpress — Version 1.0.2
• wordpress wordpress — Version 1.1.1
• wordpress wordpress — Version 1.2
• wordpress wordpress — Version 1.2.1
• wordpress wordpress — Version 1.2.2
• wordpress wordpress — Version 1.2.3
• wordpress wordpress — Version 1.2.4
• wordpress wordpress — Version 1.2.5
• wordpress wordpress — Version 1.3
• wordpress wordpress — Version 1.3.2
• wordpress wordpress — Version 1.3.3
• wordpress wordpress — Version 1.5
• wordpress wordpress — Version 1.5.1
• wordpress wordpress — Version 1.5.1.1
• wordpress wordpress — Version 1.5.1.2
• wordpress wordpress — Version 1.5.1.3
• wordpress wordpress — Version 1.5.2
• wordpress wordpress — Version 2.0
• wordpress wordpress — Version 2.0.1
• wordpress wordpress — Version 2.0.2
• wordpress wordpress — Version 2.0.4
• wordpress wordpress — Version 2.0.5
• wordpress wordpress — Version 2.0.6
• wordpress wordpress — Version 2.0.7
• wordpress wordpress — Version 2.0.8
• wordpress wordpress — Version 2.0.9
• wordpress wordpress — Version 2.0.10
• wordpress wordpress — Version 2.0.11
• wordpress wordpress — Version 2.1
• wordpress wordpress — Version 2.1.1
• wordpress wordpress — Version 2.1.2
• wordpress wordpress — Version 2.1.3
• wordpress wordpress — Version 2.2
• wordpress wordpress — Version 2.2.1
• wordpress wordpress — Version 2.2.2
• wordpress wordpress — Version 2.2.3
• wordpress wordpress — Version 2.3
• wordpress wordpress — Version 2.3.1
• wordpress wordpress — Version 2.3.2
• wordpress wordpress — Version 2.3.3
• wordpress wordpress — Version 2.5
• wordpress wordpress — Version 2.5.1
• wordpress wordpress — Version 2.6
• wordpress wordpress — Version 2.6.1
• wordpress wordpress — Version 2.6.2
• wordpress wordpress — Version 2.6.3
• wordpress wordpress — Version 2.6.5
• wordpress wordpress — Version 2.7
• wordpress wordpress — Version 2.7.1
• wordpress wordpress — Version 2.8
• wordpress wordpress — Version 2.8.1
• wordpress wordpress — Version 2.8.2
• wordpress wordpress — Version 2.8.3
• wordpress wordpress — Version 2.8.4
• wordpress wordpress — Version 2.8.5
• wordpress wordpress — Version 2.8.5.1
• wordpress wordpress — Version 2.8.5.2
• wordpress wordpress — Version 2.8.6
• wordpress wordpress — Version 2.9
• wordpress wordpress — Version 2.9.1
• wordpress wordpress — Version 2.9.1.1
• wordpress wordpress — Version 2.9.2
• wordpress wordpress — Version 3.0
• wordpress wordpress — Version 3.0.1
• wordpress wordpress — Version 3.0.2
• wordpress wordpress — Version 3.0.3
• wordpress wordpress — Version 3.0.4
• wordpress wordpress — Version 3.0.5
• wordpress wordpress — Version 3.0.6
• wordpress wordpress — Version 3.1
• wordpress wordpress — Version 3.1.1
• wordpress wordpress — Version 3.1.2
• wordpress wordpress — Version 3.1.3
• wordpress wordpress — Version 3.3

References

• core.trac.wordpress.org http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/swfupload/swfupload.swf?rev=20503
• jvn.jp http://jvn.jp/en/jp/JVN25280162/index.html
• jvndb.jvn.jp http://jvndb.jvn.jp/jvndb/JVNDB-2012-002110
• make.wordpress.org http://make.wordpress.org/core/2013/06/21/secure-swfupload/
• osvdb.org http://osvdb.org/81459
• packetstormsecurity.com http://packetstormsecurity.com/files/120746/SWFUpload-Content-Spoofing-Cross-Site-Scripting.html
• packetstormsecurity.com http://packetstormsecurity.com/files/122399/tinymce11-xss.txt
• seclists.org http://seclists.org/fulldisclosure/2013/Mar/110
• secunia.com http://secunia.com/advisories/49138
• wordpress.org http://wordpress.org/news/2012/04/wordpress-3-3-2/ Patch, Vendor Advisory
• www.debian.org http://www.debian.org/security/2012/dsa-2470
• www.openwall.com http://www.openwall.com/lists/oss-security/2013/07/18/13
• www.osvdb.org http://www.osvdb.org/91134
• www.securityfocus.com http://www.securityfocus.com/bid/53192
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/75210
• nvd.nist.gov Official NVD record