WordPress CVEs

Description

Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.

Affected WordPress components

• WordPress core
  Confirmed match
  Up to and including 3.3.1; Version 0.71; Version 1.0; Version 1.0.1; Version 1.0.2; Version 1.1.1; Version 1.2; Version 1.2.1; Version 1.2.2; Version 1.2.3; Version 1.2.4; Version 1.2.5; Version 1.3; Version 1.3.2; Version 1.3.3; Version 1.5; Version 1.5.1; Version 1.5.1.1; Version 1.5.1.2; Version 1.5.1.3; Version 1.5.2; Version 2.0; Version 2.0.1; Version 2.0.2; Version 2.0.4; Version 2.0.5; Version 2.0.6; Version 2.0.7; Version 2.0.8; Version 2.0.9; Version 2.0.10; Version 2.0.11; Version 2.1; Version 2.1.1; Version 2.1.2; Version 2.1.3; Version 2.2; Version 2.2.1; Version 2.2.2; Version 2.2.3; Version 2.3; Version 2.3.1; Version 2.3.2; Version 2.3.3; Version 2.5; Version 2.5.1; Version 2.6; Version 2.6.1; Version 2.6.2; Version 2.6.3; Version 2.6.5; Version 2.7; Version 2.7.1; Version 2.8; Version 2.8.1; Version 2.8.2; Version 2.8.3; Version 2.8.4; Version 2.8.5; Version 2.8.5.1; Version 2.8.5.2; Version 2.8.6; Version 2.9; Version 2.9.1; Version 2.9.1.1; Version 2.9.2; Version 3.0; Version 3.0.1; Version 3.0.2; Version 3.0.3; Version 3.0.4; Version 3.0.5; Version 3.0.6; Version 3.1; Version 3.1.1; Version 3.1.2; Version 3.1.3; Version 3.3

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• wordpress wordpress — Up to and including 3.3.1
• wordpress wordpress — Version 0.71
• wordpress wordpress — Version 1.0
• wordpress wordpress — Version 1.0.1
• wordpress wordpress — Version 1.0.2
• wordpress wordpress — Version 1.1.1
• wordpress wordpress — Version 1.2
• wordpress wordpress — Version 1.2.1
• wordpress wordpress — Version 1.2.2
• wordpress wordpress — Version 1.2.3
• wordpress wordpress — Version 1.2.4
• wordpress wordpress — Version 1.2.5
• wordpress wordpress — Version 1.3
• wordpress wordpress — Version 1.3.2
• wordpress wordpress — Version 1.3.3
• wordpress wordpress — Version 1.5
• wordpress wordpress — Version 1.5.1
• wordpress wordpress — Version 1.5.1.1
• wordpress wordpress — Version 1.5.1.2
• wordpress wordpress — Version 1.5.1.3
• wordpress wordpress — Version 1.5.2
• wordpress wordpress — Version 2.0
• wordpress wordpress — Version 2.0.1
• wordpress wordpress — Version 2.0.2
• wordpress wordpress — Version 2.0.4
• wordpress wordpress — Version 2.0.5
• wordpress wordpress — Version 2.0.6
• wordpress wordpress — Version 2.0.7
• wordpress wordpress — Version 2.0.8
• wordpress wordpress — Version 2.0.9
• wordpress wordpress — Version 2.0.10
• wordpress wordpress — Version 2.0.11
• wordpress wordpress — Version 2.1
• wordpress wordpress — Version 2.1.1
• wordpress wordpress — Version 2.1.2
• wordpress wordpress — Version 2.1.3
• wordpress wordpress — Version 2.2
• wordpress wordpress — Version 2.2.1
• wordpress wordpress — Version 2.2.2
• wordpress wordpress — Version 2.2.3
• wordpress wordpress — Version 2.3
• wordpress wordpress — Version 2.3.1
• wordpress wordpress — Version 2.3.2
• wordpress wordpress — Version 2.3.3
• wordpress wordpress — Version 2.5
• wordpress wordpress — Version 2.5.1
• wordpress wordpress — Version 2.6
• wordpress wordpress — Version 2.6.1
• wordpress wordpress — Version 2.6.2
• wordpress wordpress — Version 2.6.3
• wordpress wordpress — Version 2.6.5
• wordpress wordpress — Version 2.7
• wordpress wordpress — Version 2.7.1
• wordpress wordpress — Version 2.8
• wordpress wordpress — Version 2.8.1
• wordpress wordpress — Version 2.8.2
• wordpress wordpress — Version 2.8.3
• wordpress wordpress — Version 2.8.4
• wordpress wordpress — Version 2.8.5
• wordpress wordpress — Version 2.8.5.1
• wordpress wordpress — Version 2.8.5.2
• wordpress wordpress — Version 2.8.6
• wordpress wordpress — Version 2.9
• wordpress wordpress — Version 2.9.1
• wordpress wordpress — Version 2.9.1.1
• wordpress wordpress — Version 2.9.2
• wordpress wordpress — Version 3.0
• wordpress wordpress — Version 3.0.1
• wordpress wordpress — Version 3.0.2
• wordpress wordpress — Version 3.0.3
• wordpress wordpress — Version 3.0.4
• wordpress wordpress — Version 3.0.5
• wordpress wordpress — Version 3.0.6
• wordpress wordpress — Version 3.1
• wordpress wordpress — Version 3.1.1
• wordpress wordpress — Version 3.1.2
• wordpress wordpress — Version 3.1.3
• wordpress wordpress — Version 3.3

References

• core.trac.wordpress.org http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload/changelog.txt?rev=20487
• core.trac.wordpress.org http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload?rev=20487
• osvdb.org http://osvdb.org/81461
• secunia.com http://secunia.com/advisories/49138 Vendor Advisory
• wordpress.org http://wordpress.org/news/2012/04/wordpress-3-3-2/ Patch, Vendor Advisory
• www.debian.org http://www.debian.org/security/2012/dsa-2470
• www.plupload.com http://www.plupload.com/punbb/viewtopic.php?id=1685
• www.securityfocus.com http://www.securityfocus.com/bid/53192
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/75208
• nealpoole.com https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/
• nvd.nist.gov Official NVD record